CVE-2026-119499 · Package
NO FIX YET · SEE WHAT TO DO
FloristPress, a WordPress plugin by BAKKBONE Australia, inserts sensitive information into data it sends out, so the embedded data can be retrieved. An attacker can read that sensitive data from the plugin's output.
first public Nov 6, 2026 · 1 source
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
Sites running the FloristPress (bakkbone-florist-companion) WordPress plugin version 7.8.4 or earlier are described as affected. The sources do not say which data is embedded or whether authentication is needed, so the exposure path is unknown.
Not affected if plugin-not-installed
Who cares bakkbone-florist-companion, florist-sites, wordpress
7.8.4 are affected; the sources do not state a fixed versionInsertion of Sensitive Information Into Sent Data vulnerability in BAKKBONE Australia FloristPress bakkbone-florist-companion allows Retrieve Embedded Sensitive Data.This issue affects FloristPress: from n/a through 7.8.4.
This page as .md · .json · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.