# CVE-2026-78296: WP ManageNinja FluentAuth insufficient verification of data authenticity

Source: https://junglewise.ai/threats/cve-2026-78296-wp-manageninja-fluentauth-insufficient-verification-of-data  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-17. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2026-78296 · Severity: medium · CVSS 5.3 · Published 2026-09-17

FluentAuth is a WordPress authentication and security plugin that manages user authorization for WordPress sites. A flaw in how the plugin verifies the authenticity of user data allows attackers to spoof user identities without proper authentication, potentially enabling unauthorized access to accounts or administrative functions. This could lead to account takeover, data theft, or site compromise depending on the attacker's intended target.

Vendors: [WP ManageNinja LLC](https://junglewise.ai/threats/vendors/wp-manageninja-llc).

## Quick answers

**Is CVE-2026-78296 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-78296 being exploited in the wild.

**How severe is CVE-2026-78296?** Medium severity, with a CVSS score of 5.3, published 17 September 2026.

**Which products and versions are affected?** WP ManageNinja LLC FluentAuth through 2.1.2.

**Is there a fix for CVE-2026-78296?** A patch was published on 2026-09-17: Version 3.0.0 or later Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-78296 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-78296?** Check whether you run WP ManageNinja LLC FluentAuth at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is classified as insufficient verification of data authenticity (CWE-345), which allows attackers to bypass authentication checks in FluentAuth. The flaw exists in versions up to 2.1.2 and enables identity spoofing—attackers can forge or manipulate authentication tokens or session data without proper verification. No special privileges or user interaction is required; the attack is network-accessible and can be exploited by unauthenticated attackers. The vulnerability has been patched in version 3.0.0 or later. The CVSS 5.3 score reflects medium severity impact, suggesting data integrity or availability concerns rather than complete system compromise.

## Affected products

- WP ManageNinja LLC FluentAuth through 2.1.2

## Timeline

- 2026-09-17: disclosed
- 2026-09-17: patched: Version 3.0.0 or later

## References

- [https://wordpress.org/plugins](https://wordpress.org/plugins)
- [https://patchstack.com/database/wordpress/plugin/fluent-security/vulnerability/wordpress-fluentauth-plugin-3-0-0-authentication-bypass-to-account-takeover-vulnerability?_s_id=cve](https://patchstack.com/database/wordpress/plugin/fluent-security/vulnerability/wordpress-fluentauth-plugin-3-0-0-authentication-bypass-to-account-takeover-vulnerability?_s_id=cve)