# FluentCommunity – Ultra-Fast High-Performance Social Network, Community, LMS & Online Courses <= 2.11.0 - Unauthenticated Sensitive Information Exposure via Activity Feed

- **ID:** WPSEC-2026-1194
- **Plugin:** FluentCommunity – Ultra-Fast High-Performance Social Network, Community, LMS & Online Courses (`fluent-community`), https://wordpress.org/plugins/fluent-community/
- **Affected versions:** all versions before 2.12.0
- **Fixed in:** 2.12.0 (Update to 2.12.0 or later.)
- **Severity:** Low 3.7 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N)
- **Weakness:** CWE-200
- **Usage among sites WPSec scans:** plugin Low, affected versions Low (as of 2026-10-17)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/fluent-community
- **Fix released:** 2026-10-16
- **Published:** 2026-10-17
- **URL:** https://wpsec.com/vuln/WPSEC-2026-1194/

## Description

The FluentCommunity plugin for WordPress is vulnerable to Sensitive Information Exposure via the activity feed endpoint in all versions up to, and including, 2.11.0. This is due to the endpoint relying on an is_public flag that is stored when an activity is created and is not updated when a space is changed from public to private or a post is moved into a private space. This makes it possible for unauthenticated attackers, on sites whose portal is publicly accessible, to view author names and post excerpts from private spaces.

## References

- https://wpsec.com/vuln/WPSEC-2026-1194/
- https://plugins.svn.wordpress.org/fluent-community/tags/2.12.0/
- https://wordpress.org/plugins/fluent-community/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-1194/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.