Sensitive Data Exposure in FloristPress Companion Plugin

CVE-2026-119499 represents a data exposure vulnerability in BAKKBONE Australia's FloristPress companion plugin (versions through 7.8.4) where sensitive information is inadvertently inserted into outbound data transmissions. This CWE-201 weakness allows attackers to retrieve embedded sensitive data that should have been protected or redacted before transmission. FloristPress users—primarily floral businesses relying on the companion plugin for order management and customer data handling—face direct risk of credential compromise, customer PII exposure, and potential compliance violations under GDPR, CCPA, and similar regulations. The vulnerability's 7.5 CVSS score reflects the significant impact on confidentiality, though the attack requires some level of access or network positioning to exploit.

While this CVE carries no mapped MITRE ATT&CK techniques, Casky's 754 security skills powered by Claude AI with extended reasoning would detect the underlying attack patterns associated with data exfiltration and reconnaissance. Practitioners using Casky would identify suspicious outbound data flows containing unredacted sensitive fields, anomalous API responses including embedded credentials or tokens, and patterns consistent with T1041 (Exfiltration Over C2 Channel) or T1020 (Automated Exfiltration). The platform's skill-based detection would flag plugin communications containing plaintext passwords, API keys, or customer data in transit, enabling security teams to correlate these findings with known vulnerable versions and prioritize patching of FloristPress installations before exploitation occurs.