Fluent Booking WordPress Plugin Missing Authorization Vulnerability in Calendar Management

A vulnerability exists in the Fluent Booking plugin for WordPress, allowing unauthorized calendar import and management. This issue arises from a missing capability check in the 'importCalendar' function, affecting all versions up to and including 1.9.11. Authenticated attackers with subscriber-level access or higher can exploit this vulnerability to import arbitrary calendars and manage them.

Impact

Exploitation of this vulnerability allows for unauthorized users to import and manage calendars, potentially leading to misuse of scheduling and event management features.

Remediation

Users are advised to update the Fluent Booking plugin to version 1.10.0 or a newer patched version.