EUVD-2026-98356
GHSA-qrj7-gxpg-939v
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate as low-privileged WordPress user
-
ExploitSend crafted request to FluentBoards endpoint
-
ExecutionBypass missing capability check
-
ImpactRead or modify unauthorized board data
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Authorization checks on every request
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires an authenticated account on the target WordPress site with at least a low-privilege role (PR:L), since the flaw is missing/incorrect authorization checks on FluentBoards functionality rather than a pre-authentication bypass. Exploitation is limited to sites with the FluentBoards plugin installed and active at a version from n/a through 2.1.0. No user interaction is needed (UI:N) and no special non-default configuration is indicated in the description; the primary limiting factor is the need for valid authentication at minimal privilege. |
| Impact | This is a moderate-severity Missing Authorization flaw (CWE-862) in the FluentBoards WordPress plugin, rated CVSS 5.4 via vector AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N. The vector indicates a remote, low-complexity attack requiring low-privilege authentication (PR:L) and no user interaction, yielding limited confidentiality and integrity impact with no availability impact - consistent with a low-privileged authenticated user accessing or altering data they should not. No EPSS score, CISA KEV listing, POC, or SSVC decision data was provided in the input. The signals are internally consistent (broken-access-control class, partial C/I impact, authenticated vector), so there is no conflict to flag, but the absence of EPSS/KEV/POC means real-world exploitation likelihood cannot be quantified from the data given. This is a real-but-bounded priority: it requires an existing authenticated foothold and only partially impacts confidentiality and integrity, so it is a patch-in-normal-cycle issue rather than an emergency, absent evidence of active exploitation. |
| Exploit ScenarioDerived | A user with a low-privileged account on a WordPress site running a vulnerable FluentBoards version (≤ 2.1.0) sends requests to plugin endpoints that fail to enforce proper capability checks, allowing them to read or modify board data belonging to other users or boards they should not access. No public exploit code was identified in the provided data. The network vector and low attack complexity mean the action requires only standard authenticated HTTP requests. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 13, 2026
FluentBoards through version 2.1.0 contains a missing authorization flaw that allows an authenticated low-privilege WordPress user to perform actions outside their intended role, with limited confidentiality and integrity impact. The plugin must be installed and active, and the assessed CVSS vector requires PR:L, so this is not an unauthenticated bypass. No public exploit code or confirmed active exploitation was identified in the provided intelligence; the primary source is the Patchstack advisory.
RemediationAI
Update FluentBoards to a fixed release newer than 2.1.0 once the vendor advisory confirms the exact patched version; the provided input does not name a specific fixed version, so validate the Patchstack advisory before upgrading. If an update is not immediately possible, deactivate or uninstall the FluentBoards plugin to remove the vulnerable code path, accepting loss of board/project functionality. As a compensating control, restrict WordPress accounts to trusted users and review roles/capabilities so subscribers or other low-privilege users cannot reach FluentBoards endpoints; this reduces exposure but does not fix the missing authorization check. Virtual patching or WAF rules targeting the plugin vulnerable endpoints may add temporary protection, but they can be bypassed and should not replace the vendor fix.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
FluentBoards is a WordPress plugin identified by CPE cpe:2.3:a:wp_manageninja_llc:fluentboards:*:*:*:*:*:*:*:*. The vulnerability maps to CWE-862 Missing Authorization, meaning the plugin fails to verify that the requesting user has the required capability or role before allowing access to a protected function. Because CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N is the assessed vector, exploitation requires a valid low-privilege authenticated session and causes limited unauthorized read and write effects without availability impact; no non-default configuration or user interaction is required. The Authentication Bypass tag reflects the access-control class of the issue rather than an unauthenticated authentication bypass.
Know when Fluentboards gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
Remote low-complexity access requires a low-privilege authenticated account (PR:L) per the missing-authorization class; partial confidentiality and integrity impact, no availability impact.
Primary rating from Vendor (Patchstack).
CVSS VectorVendor: Patchstack
DescriptionCVE.org
Missing Authorization vulnerability in WP ManageNinja LLC FluentBoards fluent-boards allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects FluentBoards: from n/a through 2.1.0.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
More in Fluentboards
View allInformation disclosure in the FluentBoards WordPress plugin before version 2.0.15 lets any authenticated user - includin
Insecure Direct Object Reference in FluentBoards WordPress plugin before 1.95.3 allows any authenticated user holding me
Authorization bypass in FluentBoards up to 1.91.2 allows authenticated users to access and modify board data belonging t
Missing privilege verification in the FluentBoards WordPress plugin before 2.0.15 lets any authenticated member of a boa
Comment authorship spoofing in the FluentBoards WordPress plugin before 2.0.15 allows any authenticated user who is alre
Subscriber privilege escalation in FluentBoards WordPress plugin versions up to 2.0.12 lets an authenticated low-privile
Exploit-DB