CVE-2026-84766: CWE-290 Authentication Bypass by Spoofing in WP Manage Ninja FluentBooking Pro

This vulnerability (CVE-2026-84766) in FluentBooking Pro (<= 2.2.1) involves an authentication bypass by spoofing, classified under CWE-290. It allows unauthenticated attackers to bypass authentication mechanisms, impacting the integrity of the system. The CVSS 3.1 vector indicates network attack vector, high attack complexity, no privileges required, no user interaction, unchanged scope, no confidentiality impact, high integrity impact, and no availability impact. No vendor advisory or patch information is currently available.

An attacker exploiting this vulnerability can bypass authentication controls without credentials, potentially performing unauthorized actions that compromise the integrity of the affected system. There is no impact on confidentiality or availability according to the CVSS vector. No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, monitor official WP Manage Ninja channels for updates and consider restricting access to the affected plugin where possible.