{"id":"CVE-2026-119499","kind":"vulnerability","aliases":["CVE-2026-119499"],"related":[],"title":"FloristPress WordPress plugin leaks embedded sensitive data in responses","description":"Insertion of Sensitive Information Into Sent Data vulnerability in BAKKBONE Australia FloristPress bakkbone-florist-companion allows Retrieve Embedded Sensitive Data.This issue affects FloristPress: from n/a through 7.8.4.","summary":"FloristPress, a WordPress plugin by BAKKBONE Australia, inserts sensitive information into data it sends out, so the embedded data can be retrieved. An attacker can read that sensitive data from the plugin's output.","severity":"high","cvss":7.5,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["bakkbone-florist-companion","florist-sites","package","wordpress"],"not_affected_if":["plugin-not-installed"],"how_to_check":"- Check whether the FloristPress (bakkbone-florist-companion) plugin is installed and its version on the WordPress site, e.g. in the Plugins screen","fix":"- FloristPress: versions through `7.8.4` are affected; the sources do not state a fixed version","status":"open","published_at":"2026-11-06T08:17:19+00:00","first_seen_at":"2026-11-06T08:40:33+00:00","triaged_at":"2026-11-06T08:42:31+00:00","updated_at":"2026-11-06T08:42:31+00:00","category":"package","confidence":0.5,"triage":{"at":"2026-11-06T08:42:31Z","model":"claude-haiku-5-5","output":{"fix":"- FloristPress: versions through `7.8.4` are affected; the sources do not state a fixed version\n- unknown","reach":"internet","title":"FloristPress WordPress plugin leaks embedded sensitive data in responses","impact":"medium","summary":"FloristPress, a WordPress plugin by BAKKBONE Australia, inserts sensitive information into data it sends out, so the embedded data can be retrieved. An attacker can read that sensitive data from the plugin's output.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","florist-sites","bakkbone-florist-companion"],"confidence":0.5,"fix_status":"unknown","needs_auth":"unknown","worst_case":"Sensitive data embedded in plugin output can be retrieved by an attacker","analyst_note":"Find the vendor advisory or the CVE record details to confirm which data is exposed, whether login is needed, and the fixed version beyond 7.8.4.","how_to_check":"- Check whether the FloristPress (bakkbone-florist-companion) plugin is installed and its version on the WordPress site, e.g. in the Plugins screen\n- unknown for other checks; the sources do not say which data is exposed or which endpoint","plain_action":"","needs_analyst":true,"not_affected_if":["plugin-not-installed"],"who_is_affected":"Sites running the FloristPress (bakkbone-florist-companion) WordPress plugin version 7.8.4 or earlier are described as affected. The sources do not say which data is embedded or whether authentication is needed, so the exposure path is unknown.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.00072,"input_tokens":4221,"output_tokens":596,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-119499':12A,15A '-2026':11A,14A '7.8.4':86C 'affect':81C 'allow':75C 'attack':48B 'australia':31B,69C 'bakkbon':17B,30B,68C,72C 'bakkbone-florist-companion':16B,71C 'companion':19B,74C 'cve':10A,13A 'data':7A,36B,43B,53B,65C 'data.this':79C 'embed':5A,42B,77C 'florist':18B,21B,73C 'florist-sit':20B 'floristpress':1A,25B,70C,82C 'inform':34B,62C 'insert':32B,59C 'issu':80C 'leak':4A 'n/a':84C 'output':58B 'packag':23B 'plugin':3A,28B,56B 'read':50B 'respons':9A 'retriev':46B,76C 'send':38B 'sensit':6A,33B,52B,61C,78C 'sent':64C 'site':22B 'vulner':66C 'wordpress':2A,24B,27B","nicknames":[],"mitigations":[],"who_affected":"Sites running the FloristPress (bakkbone-florist-companion) WordPress plugin version 7.8.4 or earlier are described as affected. The sources do not say which data is embedded or whether authentication is needed, so the exposure path is unknown.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["bakkbonefloristcompanion","floristsites","high","package","wordpress"],"campaign_type":null,"search_a":"'-119499':12A,15A '-2026':11A,14A 'cve':10A,13A 'data':7A 'embed':5A 'floristpress':1A 'leak':4A 'plugin':3A 'respons':9A 'sensit':6A 'wordpress':2A","search_b":"'attack':48B 'australia':31B 'bakkbon':17B,30B 'bakkbone-florist-companion':16B 'companion':19B 'data':36B,43B,53B 'embed':42B 'florist':18B,21B 'florist-sit':20B 'floristpress':25B 'inform':34B 'insert':32B 'output':58B 'packag':23B 'plugin':28B,56B 'read':50B 'retriev':46B 'send':38B 'sensit':33B,52B 'site':22B 'wordpress':24B,27B","search_c":"'7.8.4':86C 'affect':81C 'allow':75C 'australia':69C 'bakkbon':68C,72C 'bakkbone-florist-companion':71C 'companion':74C 'data':65C 'data.this':79C 'embed':77C 'florist':73C 'floristpress':70C,82C 'inform':62C 'insert':59C 'issu':80C 'n/a':84C 'retriev':76C 'sensit':61C,78C 'sent':64C 'vulner':66C","first_public_at":"2026-11-06T08:17:19+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","cvss_by":"audit@patchstack.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-119499","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-119499","severity":null,"published_at":"2026-11-06T08:17:19+00:00","modified_at":"2026-11-06T08:17:19+00:00","first_seen_at":"2026-11-06T08:40:33+00:00","fetched_at":"2026-11-06T08:40:33+00:00","note":null}],"documents":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}