CVE-2025-13756 Overview
CVE-2025-13756 is a missing authorization vulnerability in the Fluent Booking plugin for WordPress. The flaw affects all versions up to and including 1.9.11. The importCalendar function lacks a capability check, allowing authenticated users with subscriber-level access or higher to import arbitrary calendars and manage them. This weakness maps to CWE-862: Missing Authorization.
The issue was fixed in version 1.10.0 of the plugin. Exploitation requires network access and low privileges, and results in a limited integrity impact on the affected WordPress site.
Critical Impact
Authenticated subscribers can import arbitrary calendars into the Fluent Booking plugin, gaining unauthorized management capabilities over booking calendar data.
Affected Products
- Fluent Booking plugin for WordPress, all versions up to and including 1.9.11
- WordPress installations with subscriber registration enabled and the plugin active
- Sites running Fluent Booking prior to the 1.10.0 release
Discovery Timeline
- 2025-12-03 - CVE-2025-13756 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2025-13756
Vulnerability Analysis
The Fluent Booking plugin exposes an importCalendar handler that processes calendar import requests from authenticated users. The handler performs its intended import logic without verifying that the calling user holds an appropriate WordPress capability. Any authenticated account, including subscriber accounts, can invoke the endpoint and import arbitrary calendar data.
Successful exploitation lets the attacker add and manage calendar entries within the plugin. The impact is bounded to integrity of booking data. Confidentiality and availability are not directly affected, and no code execution results from the flaw itself.
Root Cause
The root cause is a missing capability check in the importCalendar function within the plugin's DataImporter handler. WordPress plugins are expected to gate privileged actions using current_user_can() or an equivalent capability check. Fluent Booking authenticates the request but does not authorize it, treating subscriber sessions the same as administrator sessions for this action. The fix is visible in the 1.10.0 changeset for DataImporter.php.
Attack Vector
An attacker first obtains any authenticated WordPress account on the target site. On sites that permit open user registration, a subscriber account is sufficient. The attacker then issues a request to the plugin's admin-ajax or REST endpoint that maps to importCalendar, supplying calendar import data. Because no capability check runs, the plugin processes the request and persists the imported calendar. The attacker can then manage the imported calendars through the same unprotected code paths.
See the Wordfence advisory for CVE-2025-13756 for additional technical context.
Detect Identity Attacks the Moment Authentication Fails
Singularity™ Identity surfaces credential misuse, lateral movement, and privilege escalation in real time, so you can contain the breach before it spreads.
Stop Identity AttacksDetection Methods for CVE-2025-13756
Indicators of Compromise
- Unexpected calendar entries appearing in the Fluent Booking administration interface
- HTTP POST requests to admin-ajax.php or plugin REST routes referencing importCalendar originating from low-privilege user sessions
- New or modified calendar records in the plugin's database tables that do not correspond to administrator activity
- Subscriber accounts generating traffic to Fluent Booking management endpoints
Detection Strategies
- Review WordPress access logs for requests to Fluent Booking endpoints associated with authenticated non-administrator users
- Audit the plugin's stored calendar data for entries whose creation timestamp does not align with legitimate administrator sessions
- Correlate WordPress user role with request paths targeting DataImporter handlers
Monitoring Recommendations
- Enable WordPress audit logging that records the authenticated user, endpoint, and role for every admin-ajax and REST request
- Alert when subscriber-level accounts invoke plugin management endpoints
- Monitor for spikes in new subscriber registrations followed by requests to Fluent Booking routes
How to Mitigate CVE-2025-13756
Immediate Actions Required
- Update the Fluent Booking plugin to version 1.10.0 or later on all WordPress sites
- Inventory sites that allow open user registration and prioritize them for patching
- Review existing calendar data in Fluent Booking for unauthorized entries and remove them
- Rotate credentials for any subscriber accounts that show suspicious activity against plugin endpoints
Patch Information
The vendor addressed CVE-2025-13756 in Fluent Booking version 1.10.0 by adding a capability check to the importCalendar function. The corrective code is documented in the WordPress plugin repository changeset 3404176. Administrators should apply the update through the WordPress plugin management console or by deploying the updated plugin package.
Workarounds
- Disable the Fluent Booking plugin until the update to 1.10.0 can be applied
- Disable open user registration in WordPress settings to reduce the pool of accounts capable of exploiting the flaw
- Restrict access to admin-ajax.php and plugin REST routes at the web server or WAF layer for non-administrator sessions
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
