Is CVE-2026-111836 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-111836 being exploited in the wild.

How severe is CVE-2026-111836?

Medium severity, with a CVSS score of 4.3, published 19 October 2026.

Which products and versions are affected?

WP ManageNinja LLC FluentCommunity through 2.11.0.

Is there a fix for CVE-2026-111836?

Yes: fixed in 2.12.0. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-111836 attacked?

It is attacked over the network.

Am I affected by CVE-2026-111836?

Check whether you run WP ManageNinja LLC FluentCommunity at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-111836: WP ManageNinja FluentCommunity access control bypass

CVE-2026-111836 · Severity: medium · CVSS 4.3 · Published 2026-10-19

FluentCommunity is a WordPress plugin that manages community features and user permissions on a website. The plugin has a broken access control vulnerability that allows users with subscriber-level privileges to view pages and perform actions they should not be permitted to access, such as viewing other users' data. This could lead to unauthorized access to sensitive community information and user data.

Vendors: WP ManageNinja LLC.

Quick answers

Is CVE-2026-111836 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-111836 being exploited in the wild.
How severe is CVE-2026-111836?: Medium severity, with a CVSS score of 4.3, published 19 October 2026.
Which products and versions are affected?: WP ManageNinja LLC FluentCommunity through 2.11.0.
Is there a fix for CVE-2026-111836?: Yes: fixed in 2.12.0. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-111836 attacked?: It is attacked over the network.
Am I affected by CVE-2026-111836?: Check whether you run WP ManageNinja LLC FluentCommunity at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: 2.12.0

Technical details

A broken access control vulnerability in FluentCommunity allows authenticated users (subscribers and above) to bypass authorization checks and access resources or perform actions beyond their assigned permissions. The vulnerability requires an authenticated account but does not require admin or higher privileges. An attacker with a subscriber account can exploit misconfigured access control security levels to view or manipulate community data not intended for their access level.

Affected products

WP ManageNinja LLC FluentCommunity through 2.11.0

Timeline

2026-10-19: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.