CVE-2026-105072

Summary

FluentBooking Pro versions before 2.5.0 suffer from unauthenticated broken access control that allows attackers to modify booking data without any authentication. This vulnerability enables unauthorized users to manipulate reservations, potentially leading to double-booking, revenue loss, or data corruption.

Exploitability

Exploitation is straightforward with no prerequisites, as the vulnerability allows full write access to booking data from any unauthenticated user via exposed API endpoints.

Blast radius

The impact could be significant across all FluentBooking Pro installations under version 2.5.0, potentially affecting multiple bookings and reservation systems that rely on this plugin.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade to version 2.5.0 or later to remediate this broken access control vulnerability.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.