EUVD-2026-51931
GHSA-66hj-2rxc-44vr
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Network-accessible import endpoint requires authenticated low-privilege membership; read-only data disclosure with no integrity, availability, or scope-change impact confirms C:L/I:N/A:N/S:U.
Primary rating from Vendor (WPScan).
CVSS VectorVendor: WPScan
Lifecycle Timeline
5DescriptionCVE.org
The FluentBoards WordPress plugin before 1.95.3 does not verify that the items selected for a board import operation belong to a board the requesting user is authorized to access, allowing any authenticated user with member access to a single board to copy and read the stages and tasks (including titles, descriptions and file attachments) of any other board on the site.
AnalysisAI
Insecure Direct Object Reference in FluentBoards WordPress plugin before 1.95.3 allows any authenticated user holding member access to at least one board to silently exfiltrate task titles, descriptions, and file attachments from all other boards on the site by supplying arbitrary board item identifiers in an import request. The server performs no authorization check to verify that requested items belong to boards the invoking user is permitted to access, making any board member a potential insider threat against sensitive project data. A public proof-of-concept is available via WPScan; however, EPSS sits at 0.13% (3rd percentile) and no CISA KEV entry exists, indicating limited observed exploitation despite disclosure.
Technical ContextAI
The vulnerability is rooted in CWE-639 (Authorization Bypass Through User-Controlled Key), a class of IDOR flaw where the application uses a user-supplied identifier to route a data access decision without verifying that the authenticated user is authorized to access the referenced object. The FluentBoards plugin exposes a board import operation that accepts item identifiers - board stages and tasks - but trusts the caller-supplied IDs without checking object ownership at the server side. Because board membership grants access to the import endpoint, any member can substitute identifiers belonging to unrelated boards and retrieve their contents. Affected product scope per CPE is cpe:2.3:a:unknown:fluentboards in all versions prior to 1.95.3. The disclosure and POC are published by WPScan at https://wpscan.com/vulnerability/44d91e8d-ad2f-429c-a21e-364b1fc13fdc/.
RemediationAI
Upgrade FluentBoards to version 1.95.3 or later, the vendor-released patch that adds server-side authorization checks to the board import operation to verify that selected items belong to boards the requesting user is permitted to access. Until the patch is applied, site administrators should audit and minimize board membership, ensuring untrusted or low-trust users are not granted member roles on any board - this limits the attack surface since exploitation requires at least one active board membership. Disabling the import functionality entirely (if unused) via plugin settings or capability restrictions would eliminate exposure with no side effect on read-only board usage. Revoking user registration for public WordPress sites where board access is not needed for general site visitors is a further compensating measure. Refer to the WPScan advisory at https://wpscan.com/vulnerability/44d91e8d-ad2f-429c-a21e-364b1fc13fdc/ for additional context.
More in Fluentboards
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today