CVE-2026-9576 is an information exposure vulnerability (CWE-200) in the Fluent Booking WordPress plugin versions prior to 2.1.2. The flaw arises from the lack of verification of ownership of the requested group_id in the export endpoint. This allows users with at least the Calendar Manager role to retrieve personally identifiable information (PII) of attendees from calendar groups they do not own, including sensitive data such as names, emails, phone numbers, addresses, and payment details. The vulnerability has a CVSS 3.1 base score of 4.9, indicating medium severity. No official patch or remediation level has been confirmed as of the published date.

The vulnerability allows unauthorized disclosure of attendee PII to users with Calendar Manager privileges who do not own the targeted calendar groups. This exposure includes sensitive personal and payment information, potentially leading to privacy violations and misuse of data. There is no indication of impact on integrity or availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict Calendar Manager role assignments to trusted users only to limit exposure risk. Monitor for updates from the Fluent Booking plugin vendor regarding patches or official mitigations.