---
id: "CVE-2026-119499"
page: "https://infrastack.ai/live/CVE-2026-119499"
kind: "vulnerability"
aliases: ["CVE-2026-119499"]
title: "FloristPress WordPress plugin leaks embedded sensitive data in responses"
severity: "high"
cvss: 7.5
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["bakkbone-florist-companion", "florist-sites", "package", "wordpress"]
not_affected_if: ["plugin-not-installed"]
published_at: "2026-11-06T08:17:19+00:00"
first_seen_at: "2026-11-06T08:40:33+00:00"
updated_at: "2026-11-06T08:42:31+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-119499", "first_seen_at": "2026-11-06T08:40:33+00:00"}]
exploit_sources: []
---

# FloristPress WordPress plugin leaks embedded sensitive data in responses

Link for people: https://infrastack.ai/live/CVE-2026-119499 (this .md is for agents)

FloristPress, a WordPress plugin by BAKKBONE Australia, inserts sensitive information into data it sends out, so the embedded data can be retrieved. An attacker can read that sensitive data from the plugin's output.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check whether the FloristPress (bakkbone-florist-companion) plugin is installed and its version on the WordPress site, e.g. in the Plugins screen

## Fix

- FloristPress: versions through `7.8.4` are affected; the sources do not state a fixed version

## Timeline

- 2026-11-06T08:40:33+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-119499

## From the sources

Insertion of Sensitive Information Into Sent Data vulnerability in BAKKBONE Australia FloristPress bakkbone-florist-companion allows Retrieve Embedded Sensitive Data.This issue affects FloristPress: from n/a through 7.8.4.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_