EUVD-2026-109709
GHSA-4mvf-v862-c8hr
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessIdentify site running vulnerable WP Discussion Board
-
ExploitSend unauthenticated request to unprotected endpoint
-
ExecutionBypass missing authorization check
-
ImpactRead restricted discussion-board data
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Authorization checks on every request
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires only that a vulnerable installation of the WP Discussion Board plugin (versions up to and including 2.6.0) be network-reachable; the CVSS vector (AV:N/AC:L/PR:N/UI:N) indicates no authentication, privileges, or user interaction are needed against a default-exposed WordPress site. The available sources do not identify the exact vulnerable endpoint, parameter, or configuration that triggers the missing authorization check - the precise trigger is not described in the available sources. The principal limiting factor is impact scope: the flaw yields only low confidentiality impact (C:L, I:N, A:N), so it enables data exposure rather than modification or code execution, and exposure is bounded to sites actually running this specific plugin version. |
| Impact | This is a moderate-severity Missing Authorization flaw (CWE-862) in the WP Discussion Board WordPress plugin, scored CVSS 5.3. The supplied CVSS vector (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) indicates a network-reachable, low-complexity issue requiring no privileges and no user interaction, but with impact limited to low confidentiality only - no integrity or availability effect. The signals are internally consistent: an unauthenticated access-control gap that exposes data rather than enabling takeover. No EPSS score was provided, the CVE is NOT in CISA KEV, and the only reference is the Patchstack database entry (an advisory, not verified working exploit code), so there is no evidence of active exploitation. The vuln.today decision label is 'this_month', which aligns with a real-but-not-emergency broken-access-control bug: worth patching on a normal cycle rather than treating as a fire. Because exploitation reads data (C:L) without unauthenticated write or code execution, the real-world risk is best characterized as information disclosure in a niche plugin - a genuine issue to remediate, not a high-urgency critical. Missing data to note explicitly: no EPSS value, no CISA KEV entry, and no vendor-stated fixed version in the provided input. |
| Exploit ScenarioDerived | An unauthenticated remote attacker sends a crafted request to a WP Discussion Board plugin endpoint whose access-control check is missing or misconfigured, causing the plugin to return or act on data it should have restricted. Because no authentication, privileges, or user interaction are required (PR:N/UI:N), the request can be issued directly against any exposed site running the vulnerable version. No verified working exploit code is identified; only a Patchstack advisory reference exists. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 26, 2026
WP Discussion Board, a WordPress plugin, fails to enforce an authorization check on one of its functions in versions up to and including 2.6.0, letting remote visitors reach data or actions that should have been restricted by access-control configuration. The assessed vector (CVSS 5.3, AV:N/AC:L/PR:N/UI:N) means the flaw is exploitable over the network without credentials or user interaction against a default-exposed WordPress site, but the impact is bounded to low confidentiality exposure (C:L, I:N, A:N) rather than data modification or code execution. No public exploit code is identified at time of analysis, there is no CISA KEV listing, and the priority label is 'this_month'; the exact vulnerable endpoint, parameter or plugin configuration that triggers the missing check is not described in the available sources.
RemediationAI
No vendor-released patch version is identified in the available data at time of analysis, so the first step is to check the Patchstack advisory (https://patchstack.com/database/wordpress/plugin/wp-discussion-board/vulnerability/wordpress-wp-discussion-board-plugin-2-6-0-broken-access-control-vulnerability?_s_id=cve) and the plugin's WordPress.org page for a release newer than 2.6.0 and apply it as soon as one is published. Until a fixed build is available, practical compensating controls are to restrict network access to the plugin's front-end routes at the web server or WAF layer to only the audiences that legitimately need the discussion board (trade-off: public or community-facing boards stop working for anonymous visitors), or to deactivate WP Discussion Board entirely on installations where the board is not essential (trade-off: loss of forum functionality and possible orphaned content). Because the defect is a missing capability check rather than a configurable permission setting, changing WordPress roles or plugin options is not a reliable fix; validating the patched version against the advisory's affected range is required before considering the exposure closed.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The affected component is the WP Discussion Board plugin for WordPress, tracked under the CPE cpe:2.3:a:wp_discussion_board:wp_discussion_board, with all versions up to and including 2.6.0 in scope. WordPress plugins typically expose functionality through shortcodes, admin-ajax handlers and REST routes that are expected to gate sensitive operations behind capability checks (current_user_can) and, where relevant, nonce validation; the root cause here is classified as CWE-862 Missing Authorization, which means the code path performs an operation without verifying that the caller holds the required privilege. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms that no privileges or user interaction are prerequisites, which is consistent with a code path that simply omits the capability check instead of misconfiguring it. The exact endpoint, parameter or deployment configuration that reaches the unprotected code path is not described in the available sources, so the specific function involved should be confirmed against the Patchstack advisory and the plugin source before relying on any single request signature for detection.
Know when Wp Discussion Board gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Unauthenticated, low-complexity network access to a missing authorization check (AV:N/AC:L/PR:N/UI:N); impact is limited to information disclosure, so C:L with I:N and A:N.
Primary rating from Vendor (Patchstack).
CVSS VectorVendor: Patchstack
DescriptionCVE.org
Missing Authorization vulnerability in WP Discussion Board WP Discussion Board wp-discussion-board allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Discussion Board: from n/a through 2.6.0.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Exploit-DB