Vulnerabilities / FluentCommunity – Ultra-Fast High-Performance Social Network, Community, LMS & Online Courses / WPSEC-2026-1194
FluentCommunity – Ultra-Fast High-Performance Social Network, Community, LMS & Online Courses <= 2.11.0 - Unauthenticated Sensitive Information Exposure via Activity Feed
Low 3.7
CWE-200Fixed in 2.12.0
- ID
- WPSEC-2026-1194
- Plugin
- FluentCommunity – Ultra-Fast High-Performance Social Network, Community, LMS & Online Courses (fluent-community)
- Affected
- all versions before 2.12.0
- Remediation
- Update to 2.12.0 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
- Weakness
- CWE-200
- Usage
- Plugin Low · Affected versions Low among sites WPSec scans, 2026-10-17
- Attack surface
- FluentCommunity – Ultra-Fast High-Performance Social Network, Community, LMS & Online Courses on WPSec AttackSurface
- Fix released
- Published
Description
The FluentCommunity plugin for WordPress is vulnerable to Sensitive Information Exposure via the activity feed endpoint in all versions up to, and including, 2.11.0. This is due to the endpoint relying on an is_public flag that is stored when an activity is created and is not updated when a space is changed from public to private or a post is moved into a private space. This makes it possible for unauthenticated attackers, on sites whose portal is publicly accessible, to view author names and post excerpts from private spaces.
References
- https://wpsec.com/vuln/WPSEC-2026-1194/
- https://plugins.svn.wordpress.org/fluent-community/tags/2.12.0/
- https://wordpress.org/plugins/fluent-community/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS