Fluent Booking – The Ultimate Appointments Scheduling, Events Booking, Events Calendar Solution Security & Risk Analysis

The 'fluent-booking' v2.0.05 plugin exhibits a mixed security posture. On the positive side, it demonstrates strong adherence to secure coding practices by utilizing prepared statements for 94% of its SQL queries and properly escaping 97% of its output. The absence of dangerous functions and critical or high-severity taint flows is also encouraging. However, a significant concern lies in its attack surface, with 6 out of 13 entry points (AJAX handlers and shortcodes) lacking proper authentication checks. This could allow unauthenticated users to trigger sensitive actions or expose information.

The vulnerability history indicates a past struggle with security, specifically concerning missing authorization, evidenced by two medium-severity CVEs. While there are currently no unpatched vulnerabilities, the recurrence of authorization issues in the past suggests a potential area for ongoing vigilance. The latest vulnerability in 2025 is concerning if this version is actively maintained and this indicates a pattern of historical vulnerabilities that may not be fully addressed in this version or indicate a recurring issue.

In conclusion, while the plugin has made significant strides in adopting secure coding practices like prepared statements and output escaping, the presence of unprotected AJAX handlers and a history of authorization vulnerabilities represent the most significant risks. The large number of unprotected entry points needs to be addressed to mitigate potential exploitation by unauthenticated users. The development team should prioritize a thorough review of authorization mechanisms across all entry points.