Description

Insertion of Sensitive Information Into Sent Data vulnerability in BAKKBONE Australia FloristPress bakkbone-florist-companion allows Retrieve Embedded Sensitive Data.This issue affects FloristPress: from n/a through 7.8.4.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.5",
  "pubDate": "2026-11-06T08:17:19.063Z",
  "pubdate": "2026-11-06T08:17:19.063Z",
  "executiveSummary": "The FloristPress plugin for WordPress, developed by BAKKBONE Australia, is susceptible to an 'Insertion of Sensitive Information Into Sent Data' vulnerability. This flaw allows unauthorized entities to retrieve sensitive information that is inadvertently embedded within data transmitted by the application.\nThe vulnerability affects all versions of FloristPress from n/a up to and including 7.8.4. The issue arises from insecure data handling practices where sensitive parameters are included in outgoing data streams without adequate sanitization or access control enforcement.\nThis vulnerability poses a significant risk to the confidentiality of florist shop data, customer information, or plugin-specific credentials. An attacker capable of intercepting or accessing these data streams could potentially gain unauthorized access to sensitive application configurations or user-specific data. Exploitation does not necessarily require highly sophisticated techniques, as it often involves inspecting outgoing network requests or data responses generated by the plugin's functionality. The impact of this vulnerability is the potential for unauthorized data disclosure, which can lead to further exploitation of the WordPress environment.",
  "technicalDetails": "The vulnerability, identified as Insertion of Sensitive Information Into Sent Data, stems from improper data output management within the FloristPress plugin. The root cause is the inclusion of sensitive, non-public data within API responses, AJAX calls, or client-side data objects that are subsequently transmitted to the end-user's browser or intercepted over the network.\nWhen the FloristPress plugin processes requests, it fails to filter or sanitize the payload before serialization and transmission. Sensitive information—such as database configuration snippets, internal API keys, or administrative metadata—is inadvertently bundled into the server response. Because the application logic does not distinguish between data required for client-side functionality and data that should remain strictly server-side, this sensitive content is delivered directly to the client's HTTP response buffer.\nThe attack flow typically follows this sequence: An attacker monitors the network traffic between the client and the WordPress server while interacting with the FloristPress plugin features. Alternatively, an attacker may examine the client-side JavaScript or hidden HTML fields populated by the plugin. Upon identifying the specific endpoint or function responsible for the sensitive data return, the attacker triggers the associated request. The server, failing to enforce strict output filtering, sends the data payload containing the sensitive information back to the client. The attacker then parses the response to extract the exposed credentials or configuration data.\nThis vulnerability is inherent to the plugin's data handling logic and does not appear to require specific elevated privileges or complex authentication bypasses if the vulnerable endpoints are publicly accessible. The network exposure is broad, as any user or entity capable of initiating the affected requests can capture the sensitive data. Post-exploitation, the impact is significant; extracted credentials may allow an attacker to escalate privileges, access the database, or pivot into other areas of the WordPress installation. This represents a failure in 'Security by Design' regarding data encapsulation in the plugin’s communication layer."
}