{
 "id": "WPSEC-2026-1194",
 "url": "https://wpsec.com/vuln/WPSEC-2026-1194/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-1194/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-1194/index.md",
 "title": "FluentCommunity – Ultra-Fast High-Performance Social Network, Community, LMS & Online Courses <= 2.11.0 - Unauthenticated Sensitive Information Exposure via Activity Feed",
 "description": "The FluentCommunity plugin for WordPress is vulnerable to Sensitive Information Exposure via the activity feed endpoint in all versions up to, and including, 2.11.0. This is due to the endpoint relying on an is_public flag that is stored when an activity is created and is not updated when a space is changed from public to private or a post is moved into a private space. This makes it possible for unauthenticated attackers, on sites whose portal is publicly accessible, to view author names and post excerpts from private spaces.",
 "plugin": {
  "slug": "fluent-community",
  "name": "FluentCommunity – Ultra-Fast High-Performance Social Network, Community, LMS & Online Courses",
  "full_name": "FluentCommunity – Ultra-Fast High-Performance Social Network, Community, LMS & Online Courses",
  "wordpress_org": "https://wordpress.org/plugins/fluent-community/",
  "advisories_url": "https://wpsec.com/vuln/plugin/fluent-community/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/fluent-community"
 },
 "type": "SENSITIVE DATA DISCLOSURE",
 "cwe": [
  "CWE-200"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 3.7,
  "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N",
  "severity": "Low"
 },
 "affected": {
  "ranges": [
   {
    "from": null,
    "from_inclusive": true,
    "to": "2.12.0",
    "to_inclusive": false
   }
  ],
  "text": [
   "all versions before 2.12.0"
  ]
 },
 "introduced_in": null,
 "fixed_in": "2.12.0",
 "remediation": "Update to 2.12.0 or later.",
 "fix_released": "2026-10-16T14:13:48+00:00",
 "published": "2026-10-17T14:43:07+00:00",
 "updated": "2026-10-17T09:25:46.697774+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-1194/",
  "https://plugins.svn.wordpress.org/fluent-community/tags/2.12.0/",
  "https://wordpress.org/plugins/fluent-community/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/fluent-community",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Low",
  "affected_versions": "Low",
  "as_of": "2026-10-17"
 }
}