CVE-2026-122660: WordPress FloristPress plugin <= 7.8.5 - Broken Access Control vulnerability

Q: Which FloristPress installations are affected?

The issue affects FloristPress versions through 7.8.5. The available data does not identify a fixed version.

Q: What access or conditions are required to exploit this vulnerability?

The available data identifies missing authorization and incorrectly configured access-control security levels, but does not specify the attacker privileges, endpoint, or configuration conditions required for exploitation.

Q: How can I determine whether my site is vulnerable?

Check whether the installed bakkbone-florist-companion plugin version is 7.8.5 or earlier. The provided data does not include indicators of compromise or a method to verify exploitation.

Published Nov 7, 2026

Updated

Missing Authorization vulnerability in BAKKBONE Australia FloristPress bakkbone-florist-companion allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects FloristPress: from n/a through 7.8.5.

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade WordPress FloristPress plugin to a version that resolves this vulnerability.
Fixed in 7.8.6

Event History

Nov 7, 2026

CVE Published

via MITRE·12:38 PM

Data Sourced

via MITRE·12:38 PM

RemedyDescriptionSeverityWeakness

Frequently Asked Questions

Which FloristPress installations are affected?

The issue affects FloristPress versions through 7.8.5. The available data does not identify a fixed version.

What access or conditions are required to exploit this vulnerability?

The available data identifies missing authorization and incorrectly configured access-control security levels, but does not specify the attacker privileges, endpoint, or configuration conditions required for exploitation.

How can I determine whether my site is vulnerable?

Check whether the installed bakkbone-florist-companion plugin version is 7.8.5 or earlier. The provided data does not include indicators of compromise or a method to verify exploitation.

CVE-2026-122660: WordPress FloristPress plugin <= 7.8.5 - Broken Access Control vulnerability

Remediation

Event History

Frequently Asked Questions

Which FloristPress installations are affected?

What access or conditions are required to exploit this vulnerability?

How can I determine whether my site is vulnerable?

Company

Resources

Contact

Frequently Asked Questions

Which FloristPress installations are affected?

What access or conditions are required to exploit this vulnerability?

How can I determine whether my site is vulnerable?