AUGUST 24, 2026
Live Feed
Back to database
Case File

CVE-2026-9576

MEDIUM · CVSS 4.9 EPSS 0.23%

Source: NVD + CISA KEV + EPSS (historical backfill) · Published 2026-06-30 · Last synced 2026-08-04

CyberRota Analysis

This is a medium severity vulnerability with a CVSS score of 4.9. It affects WordPress.

CVE
CVE-2026-9576
Severity
MEDIUM
CVSS
4.9
EPSS
0.23%
WordPress

Original NVD Description

The Fluent Booking WordPress plugin before 2.1.2 does not verify ownership of the requested group_id before exporting attendee data via the export endpoint, allowing users with at least the Calendar Manager role to retrieve attendees' PII (name, email, phone, address, payment information) from calendar groups they do not own.