---
id: "CVE-2026-111836"
kind: "vulnerability"
aliases: ["CVE-2026-111836"]
title: "FluentCommunity WordPress plugin: missing authorization check through 2.11.0"
severity: "medium"
cvss: 4.3
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["fluent-community", "package", "wordpress"]
not_affected_if: ["plugin-not-installed"]
published_at: "2026-10-19T13:16:56+00:00"
first_seen_at: "2026-10-23T21:57:18+00:00"
updated_at: "2026-10-25T04:39:39+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-111836", "first_seen_at": "2026-10-23T21:57:18+00:00"}]
---

# FluentCommunity WordPress plugin: missing authorization check through 2.11.0

FluentCommunity, a WordPress community plugin by ManageNinja, has an access control flaw where a missing authorization check lets actions run without the right permissions. The sources say the affected range runs through version 2.11.0 but do not say which actions or what data an attacker can reach.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed FluentCommunity version in the WordPress admin plugins list or with `wp plugin get fluent-community --field=version`
- Compare the result against the affected range through `2.11.0`

## Fix

- Update FluentCommunity to a version later than `2.11.0`, as published by the vendor (the fixed version number is unknown from the sources)

## Timeline

- 2026-10-23T21:57:18+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-111836

## From the sources

Missing Authorization vulnerability in WP ManageNinja LLC FluentCommunity fluent-community allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects FluentCommunity: from n/a through 2.11.0.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_