CVE-2026-78296

MediumCVSS 5.3

Published: 17/09/2026(UTC)Updated: 19/09/2026(UTC)Translated: 17/09/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.11%

1th percentile - higher than 1% of all known CVEs

Summary

The FluentAuth WordPress plugin in versions up to and including 2.1.2 has insufficient verification of data authenticity, allowing identity spoofing. An attacker could exploit this to impersonate another identity within the system.

Risk Assessment

Identity spoofing can lead to unauthorized access to protected resources and actions performed on behalf of other users. Organizations using FluentAuth are exposed to authentication security breaches.

Recommendation

Update the FluentAuth plugin to a version later than 2.1.2 that contains the fix. If updating is not possible, consider disabling the plugin until the patch is applied.

Other vulnerabilities in FluentAuth

CVE-2025-13728Medium
The FluentAuth – The Ultimate Authorization & Security Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's `fluent_auth_reset_password` shortcode in all versions up to and including 2.0.3 due to insufficient input sanitization and output escaping on user supplied attributes. This allows authenticated attackers with contributor level access and above to inject arbitrary web scripts in pages that execute whenever a user accesses an injected page.

Original NVD description (English source)

Insufficient Verification of Data Authenticity vulnerability in WP ManageNinja LLC FluentAuth allows Identity Spoofing. This issue affects FluentAuth: from n/a through 2.1.2.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS