CVE-2026-81273
Received Received - Intake

Unauthenticated CSRF in FluentBooking Pro

Publication date: 2026-08-27

Last updated on: 2026-08-27

Assigner: Patchstack

Description
Unauthenticated Cross Site Request Forgery (CSRF) in FluentBooking Pro <= 2.2.4 versions.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-27
Last Modified
2026-08-27
Generated
2026-08-27
AI Q&A
2026-08-27
EPSS Evaluated
N/A
NVD
CVE-2026-81273
EUVD
EUVD-2026-66951

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
fluentbooking fluentbooking_pro to 2.2.4 (inc)
fluentbooking pro to 2.2.4 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-352 The web application does not, or cannot, sufficiently verify whether a request was intentionally provided by the user who sent the request, which could have originated from an unauthorized actor.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is an Unauthenticated Cross Site Request Forgery (CSRF) vulnerability in FluentBooking Pro plugin versions 2.2.4 and below. It allows attackers to trick authenticated users into executing unwanted actions by leveraging their active session without needing to know their credentials.

Detection Guidance

This vulnerability requires checking the installed version of the FluentBooking Pro plugin. Use WordPress CLI with the command: wp plugin list | grep fluent-booking-pro. Alternatively, check the plugin version in the WordPress admin panel under Plugins.

Impact Analysis

An attacker could force higher privileged users to perform actions like changing settings, creating or deleting bookings, or modifying user permissions. This could lead to unauthorized access, data manipulation, or service disruption if the victim has administrative rights.

Compliance Impact

This vulnerability could lead to unauthorized data modifications or access, potentially violating GDPR's integrity and confidentiality principles or HIPAA's safeguards for protected health information. Organizations may face compliance violations if user data is compromised through this exploit.

Mitigation Strategies

Update the FluentBooking Pro plugin to version 2.2.5 or later immediately. If updating is not possible, contact your hosting provider or web developer for assistance. Enable auto-updates for vulnerable plugins if using Patchstack.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-81273. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart