PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-119499 BAKKBONE Australia CVE debrief

A CVE record was published on 2026-11-06T08:17:19.063Z and has not been modified since then. The NVD entry is currently Deferred. This issue affects FloristPress plugin versions up to 7.8.4. Defenders and administrators should assess their exposure and consider necessary actions to protect sensitive data. The vulnerability has a CVSS score of 7.5, indicating high severity. The CVE Program and NVD provide official details on this vulnerability. The debrief is based on the supplied source corpus and aims to provide an executive overview of the vulnerability.

Vendor
BAKKBONE Australia
Product
FloristPress
CVSS
HIGH 7.5
CISA KEV
Not listed in stored evidence
Original CVE published
2026-11-06
Original CVE updated
2026-11-06
Advisory published
2026-11-06
Advisory updated
2026-11-06

Who should care

Defenders and administrators using FloristPress plugin versions up to 7.8.4 should assess their exposure and consider necessary actions to protect sensitive data.

Why it matters

Defenders should care about CVE-2026-119499 because it involves a high-severity vulnerability in the FloristPress plugin, potentially leading to sensitive data exposure. Administrators and defenders using affected versions should verify their exposure, consider updates or mitigations, and monitor for potential data breaches.

  • Potential sensitive data exposure in FloristPress plugin versions up to 7.8.4
  • Need for verification of plugin version and exposure in environments
  • Possible data retrieval by unauthorized parties

Technical summary

The FloristPress plugin up to version 7.8.4 has an Insertion of Sensitive Information Into Sent Data vulnerability, allowing for the retrieval of embedded sensitive data. This issue has a CVSS score of 7.5, indicating high severity. Defenders should prioritize verifying exposure in their environments, especially those using FloristPress plugin versions up to 7.8.4, and assess the need for updates or mitigations. The vulnerability class involves sensitive data exposure, and defenders should review official advisories and CVE records for affected scope, severity,

Defensive priority

Defenders should prioritize verifying exposure in their environments, especially those using FloristPress plugin versions up to 7.8.4, and assess the need for updates or mitigations.

Recommended defensive actions

  • Verify FloristPress plugin version and assess exposure
  • Consider updating to a fixed version if available
  • Monitor for potential sensitive data exposure

Evidence notes

The CVE record indicates an Insertion of Sensitive Information Into Sent Data vulnerability in FloristPress plugin versions up to 7.8.4. The CVSS score is 7.5, indicating high severity. However, details on exploitation or specific impacts are limited.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-119499 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-119499

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-119499 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-119499

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.