CVE-2026-122660

Description

Missing Authorization vulnerability in BAKKBONE Australia FloristPress bakkbone-florist-companion allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects FloristPress: from n/a through 7.8.5.

Overview

State: PUBLISHED
Assigner (CNA): Patchstack
CVSS severity: MEDIUM
CVSS score: 4.3 / 10
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Effective score: 4.3 / 10 MEDIUM source: CNA overview
CWE(s): CWE-862
Reserved: 2026-11-05
Published: 2026-11-07 12:38 UTC
Last updated: 2026-11-07 18:26 UTC
Source: https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/122xxx/CVE-2026-122660.json

European Union Vulnerability Database ENISA EUVD

ENISA's official EU repository for curated vulnerability intelligence. Carries a separate identifier (EUVD-YYYY-NNNN) and frequently exposes an earlier-published description + CVSS than NVD does.

EUVD ID: EUVD-2026-119243

EUVD enrichment is queued; refresh the page in a few seconds.

Affected products (1)

Vendor	Product	Versions	Platforms
BAKKBONE Australia	FloristPress	`0` (affected)	—

Vendor references (1)

References embedded in the original CVE record by the assigning CNA.

https://patchstack.com/database/wordpress/plugin/bakkbone-florist-companion/vulnerability/wordpress-floristpress-plugin-7-8-5-broken-access-control-vulnerability?_s_id=cve vdb-entry

Web references (0)

DuckDuckGo results ranked by threat-intel / vendor advisory domains. Generated by the 🔎 Find references (web) button above — same flow as the Remediations search.

No web references attached yet.

Remediations (10)

October 2026 Critical Patch Update Released | security

web:blogs.oracle.com

For more information about the Critical Patch Update program, see the security vulnerability remediation practices page located on the Oracle Trust Center.

2026-11-08 11:34 UTC
Car Values | Fix it up Wiki | Fandom

web:fix-it-up.fandom.com

1 Merquis G Wafer 2 Porx JT3 RF 3 Mata FX7 4 Porx JT2 RF 5 Missah Groundline F34 6 Missah Groundline F32 7 Kart 8 Holde NisX 9 DOGO Desafio 10 Missah Silva S15 11 Chule Curgette C7 12 McLumber 520 13 Vemca K3 G 14 Toyoda Supwa A90 15 Lambemos Iris 16 Sucato Empresa 17 Four Mustank Hoonicorn 18 Missah JTF 19 Lambemos Golhoes 20 Lararry R40 21 Toyoda Supwa 22 Holde S2k 23 Four JF 24 Mata 787F 25 ...

2026-11-08 11:34 UTC
Fix it up Wiki | Fandom

web:fix-it-up.fandom.com

Fix It Up is a Roblox car repair simulator game developed by .workspace. Players buy or find broken cars, repair damaged parts, customize them, and sell them for profit.

2026-11-08 11:34 UTC
SkyBlock Patch Notes | Hypixel Forums

web:hypixel.net

All SkyBlock Patch Notes can be found here! You can click the Watch button in this section to be alerted when new Patch Notes are released!

2026-11-08 11:34 UTC
Fixes — lua.tools

web:lua.tools

Download Steam app manifest Lua files by App ID or game name. Fast, free, and easy.

2026-11-08 11:34 UTC
WoW Forever Patch Notes by Class: All Changes (Nov 4, 2026)

web:patchmymain.com

Every WoW: Forever change from Blizzard's official notes, sorted by class, spec and race, with source links. Latest build: Nov 4, 2026 .

2026-11-08 11:34 UTC
Patch Instructions - Saikey Store

web:saikeystudios.com

Open the executable (.exe) patch file downloaded from our website and select the same language that was chosen in the Steam properties. Then click "OK".

2026-11-08 11:34 UTC
Body recovered in Route 37 bridge jumping incident

web:www.app.com

The body of the first man to jump off the J. Stanley Tunney Bridge on Route 37 was recovered Tuesday morning. The other jumper was saved.

2026-11-08 11:34 UTC
Airlines keep giving passengers freebies they don't want. Why?

web:www.usatoday.com

The hidden cost of airline freebies: Are they worth it? From uneaten meals to unused amenity kits, airline freebies create waste and add costs. Are passengers better off without them?

2026-11-08 11:34 UTC
YoshiTracker — when is the next Deadlock patch?

web:www.yoshitracker.com

Live odds on when Valve will ship the next Deadlock patch — from Yoshi's forum activity, pizza queues by Valve HQ, flights into Bellevue, and Gabe's yacht.

2026-11-08 11:34 UTC

AI Forensic Analysis

Only Available for Registered Users. Sign in to view.

Raw JSON

The full cvelistV5 record. Download as CVE-2026-122660.json.

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-122660",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-11-07T18:14:54.930151Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-11-07T18:26:29.625Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://wordpress.org/plugins",
          "defaultStatus": "unaffected",
          "packageName": "bakkbone-florist-companion",
          "product": "FloristPress",
          "vendor": "BAKKBONE Australia",
          "versions": [
            {
              "changes": [
                {
                  "at": "7.8.6",
                  "status": "unaffected"
                }
              ],
              "lessThanOrEqual": "7.8.5",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "ashv4ni | Patchstack Bug Bounty Program"
        }
      ],
      "datePublic": "2026-11-07T12:38:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Missing Authorization vulnerability in BAKKBONE Australia FloristPress bakkbone-florist-companion allows Exploiting Incorrectly Configured Access Control Security Levels.<p>This issue affects FloristPress: from n/a through 7.8.5.</p>"
            }
          ],
          "value": "Missing Authorization vulnerability in BAKKBONE Australia FloristPress bakkbone-florist-companion allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects FloristPress: from n/a through 7.8.5."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-180",
          "descriptions": [
            {
              "lang": "en",
              "value": "Exploiting Incorrectly Configured Access Control Security Levels"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 4.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "LOW",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-862",
              "description": "Missing Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-07T12:38:49.477Z",
        "orgId": "21595511-bba5-4825-b968-b78d1f9984a3",
        "shortName": "Patchstack"
      },
      "references": [
        {
          "tags": [
            "vdb-entry"
          ],
          "url": "https://patchstack.com/database/wordpress/plugin/bakkbone-florist-companion/vulnerability/wordpress-floristpress-plugin-7-8-5-broken-access-control-vulnerability?_s_id=cve"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Update the WordPress FloristPress plugin to the latest available version (at least 7.8.6)."
            }
          ],
          "value": "Update the WordPress FloristPress plugin to the latest available version (at least 7.8.6)."
        }
      ],
      "tags": [
        "x_open-source"
      ],
      "title": "WordPress FloristPress plugin <= 7.8.5 - Broken Access Control vulnerability"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "21595511-bba5-4825-b968-b78d1f9984a3",
    "assignerShortName": "Patchstack",
    "cveId": "CVE-2026-122660",
    "datePublished": "2026-11-07T12:38:48.962Z",
    "dateReserved": "2026-11-05T00:21:25.471Z",
    "dateUpdated": "2026-11-07T18:26:29.625Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}