CVE-2025-13756 is a missing authorization vulnerability (CWE-862) in the Fluent Booking plugin for WordPress, affecting all versions up to 1.9.11. The issue arises because the importCalendar function lacks a capability check, allowing authenticated users with low privileges (subscriber level and above) to import and manage calendars arbitrarily. This could lead to unauthorized modification of calendar data within the plugin. The vulnerability has a CVSS 3.1 base score of 4.3, indicating medium severity, with no impact on confidentiality or availability but limited impact on integrity.

The vulnerability allows authenticated users with subscriber-level access or higher to import and manage calendars without proper authorization. This could result in unauthorized calendar data manipulation, potentially affecting the integrity of scheduling and event information managed by the plugin. There is no impact on confidentiality or availability reported. No known exploits have been observed in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict user roles to trusted individuals and monitor plugin updates from the vendor. Avoid granting subscriber or higher privileges to untrusted users to reduce risk.