CVE-2026-119499: WordPress FloristPress plugin <= 7.8.4 - Sensitive Data Exposure vulnerability

Q: Which installations should be treated as potentially affected?

FloristPress installations running version 7.8.4 or an earlier affected release should be treated as potentially affected. The available data does not identify a lower bound for affected versions.

Q: What information could be exposed?

The issue allows retrieval of sensitive information embedded in sent data. The available data does not specify the exact types of sensitive data or the conditions required to retrieve them.

Published Nov 6, 2026

Updated

Insertion of Sensitive Information Into Sent Data vulnerability in BAKKBONE Australia FloristPress bakkbone-florist-companion allows Retrieve Embedded Sensitive Data.This issue affects FloristPress: from n/a through 7.8.4.

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade WordPress FloristPress plugin to a version that resolves this vulnerability.
Fixed in 7.8.5

Event History

Nov 6, 2026

CVE Published

via MITRE·08:00 AM

Data Sourced

via MITRE·08:00 AM

RemedyDescriptionSeverityWeakness

Data Sourced

via NVD·08:17 AM

DescriptionSeverityWeakness

Frequently Asked Questions

Which installations should be treated as potentially affected?

FloristPress installations running version 7.8.4 or an earlier affected release should be treated as potentially affected. The available data does not identify a lower bound for affected versions.

What information could be exposed?

The issue allows retrieval of sensitive information embedded in sent data. The available data does not specify the exact types of sensitive data or the conditions required to retrieve them.

CVE-2026-119499: WordPress FloristPress plugin <= 7.8.4 - Sensitive Data Exposure vulnerability

Remediation

Event History

Frequently Asked Questions

Which installations should be treated as potentially affected?

What information could be exposed?

Company

Resources

Contact

Frequently Asked Questions

Which installations should be treated as potentially affected?

What information could be exposed?