CVE-2026-78296: WordPress FluentAuth plugin <= 2.1.2 - Email Verification Bypass vulnerability

FluentAuth versions through 2.1.2 are identified as affected. The provided data does not identify an unaffected fixed version.

No. The CVSS vector indicates network-based exploitation with low attack complexity, no privileges required, and no user interaction required.

The issue is described as enabling identity spoofing. The CVSS vector indicates low integrity impact and no confidentiality or availability impact.

Published Sep 17, 2026

Updated

Insufficient Verification of Data Authenticity vulnerability in WP ManageNinja LLC FluentAuth allows Identity Spoofing.

This issue affects FluentAuth: from n/a through 2.1.2.

Affected Software

1 affected component

WP ManageNinja LLC FluentAuth<=2.1.2

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade WordPress FluentAuth – The Ultimate Authorization & Security Plugin for WordPress to a version that resolves this vulnerability.
Fixed in 3.0.0

Sep 17, 2026

CVE Published

via MITRE·11:05 AM

Data Sourced

via MITRE·11:05 AM

RemedyDescriptionSeverityWeakness

FluentAuth versions through 2.1.2 are identified as affected. The provided data does not identify an unaffected fixed version.

No. The CVSS vector indicates network-based exploitation with low attack complexity, no privileges required, and no user interaction required.

The issue is described as enabling identity spoofing. The CVSS vector indicates low integrity impact and no confidentiality or availability impact.