{"id":"CVE-2026-111836","kind":"vulnerability","aliases":["CVE-2026-111836"],"related":[],"title":"FluentCommunity WordPress plugin: missing authorization check through 2.11.0","description":"Missing Authorization vulnerability in WP ManageNinja LLC FluentCommunity fluent-community allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects FluentCommunity: from n/a through 2.11.0.","summary":"FluentCommunity, a WordPress community plugin by ManageNinja, has an access control flaw where a missing authorization check lets actions run without the right permissions. The sources say the affected range runs through version 2.11.0 but do not say which actions or what data an attacker can reach.","severity":"medium","cvss":4.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["fluent-community","package","wordpress"],"not_affected_if":["plugin-not-installed"],"how_to_check":"- Check the installed FluentCommunity version in the WordPress admin plugins list or with `wp plugin get fluent-community --field=version`\n- Compare the result against the affected range through `2.11.0`","fix":"- Update FluentCommunity to a version later than `2.11.0`, as published by the vendor (the fixed version number is unknown from the sources)","status":"open","published_at":"2026-10-19T13:16:56+00:00","first_seen_at":"2026-10-23T21:57:18+00:00","triaged_at":"2026-10-25T04:39:39+00:00","updated_at":"2026-10-25T04:39:39+00:00","category":"package","confidence":0.5,"triage":{"at":"2026-10-25T04:39:39Z","model":"claude-haiku-5-5","output":{"fix":"- Update FluentCommunity to a version later than `2.11.0`, as published by the vendor (the fixed version number is unknown from the sources)","reach":"internet","title":"FluentCommunity WordPress plugin: missing authorization check through 2.11.0","impact":"medium","summary":"FluentCommunity, a WordPress community plugin by ManageNinja, has an access control flaw where a missing authorization check lets actions run without the right permissions. The sources say the affected range runs through version 2.11.0 but do not say which actions or what data an attacker can reach.","category":"package","nicknames":[],"who_cares":["wordpress","fluent-community"],"confidence":0.5,"needs_auth":"unknown","worst_case":"unknown access to community data or actions the plugin should restrict","analyst_note":"Check the NVD entry and the plugin's changelog for the fixed version and which endpoint lacks the authorization check.","how_to_check":"- Check the installed FluentCommunity version in the WordPress admin plugins list or with `wp plugin get fluent-community --field=version`\n- Compare the result against the affected range through `2.11.0`","needs_analyst":true,"not_affected_if":["plugin-not-installed"],"who_is_affected":"Sites running the FluentCommunity plugin at version 2.11.0 or earlier are in the affected range. The sources do not say which roles or endpoints are involved, so whether a logged-out visitor can reach the flaw is unknown. Sites without the plugin installed are not affected.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000611,"input_tokens":3311,"output_tokens":559,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-111836':11A,14A '-2026':10A,13A '2.11.0':8A,53B,92C 'access':29B,82C 'action':38B,59B 'affect':48B,87C 'allow':78C 'attack':64B 'author':5A,35B,68C 'check':6A,36B 'communiti':17B,23B,77C 'configur':81C 'control':30B,83C 'cve':9A,12A 'data':62B 'exploit':79C 'flaw':31B 'fluent':16B,76C 'fluent-commun':15B,75C 'fluentcommun':1A,20B,74C,88C 'incorrect':80C 'issu':86C 'let':37B 'levels.this':85C 'llc':73C 'manageninja':26B,72C 'miss':4A,34B,67C 'n/a':90C 'packag':18B 'permiss':43B 'plugin':3A,24B 'rang':49B 'reach':66B 'right':42B 'run':39B,50B 'say':46B,57B 'secur':84C 'sourc':45B 'version':52B 'vulner':69C 'without':40B 'wordpress':2A,19B,22B 'wp':71C","nicknames":[],"mitigations":[],"who_affected":"Sites running the FluentCommunity plugin at version 2.11.0 or earlier are in the affected range. The sources do not say which roles or endpoints are involved, so whether a logged-out visitor can reach the flaw is unknown. Sites without the plugin installed are not affected.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-19T13:16:56+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","cvss_by":"audit@patchstack.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-111836","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-111836","severity":null,"published_at":"2026-10-19T13:16:56+00:00","modified_at":"2026-10-19T19:17:23+00:00","first_seen_at":"2026-10-23T21:57:18+00:00","fetched_at":"2026-10-23T22:28:57+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}