What is the CVSS score of CVE-2026-7523?

CVE-2026-7523 has a CVSS 3.1 base score of 4.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N. EPSS exploitation probability: 0.0%.

Alba Board CVE-2026-7523

EUVD-2026-34923 MEDIUM

Missing Authorization (CWE-862)

2026-06-05 Wordfence

GHSA-rw36-f5j3-hj4c

Authentication Bypass WordPress

4.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

4.3 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jun 05, 2026 - 23:16 vuln.today

CVE Published

Jun 05, 2026 - 22:28 nvd

MEDIUM 4.3

DescriptionCVE.org

The Alba Board plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.1.3. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with subscriber-level access and above, to access arbitrary private alba_card post data, including title, description, assignee, due date, tags, and comments, that is intended to be restricted to Administrators and Editors. The handler is registered via the wp_ajax_nopriv_ hook and its nonce is exposed to all site visitors through wp_localize_script on pages containing the [alba_board] shortcode, making this exploitable by unauthenticated users who can access any such page.

AnalysisAI

Authorization bypass in the Alba Board WordPress plugin (all versions through 2.1.3) exposes private project card data to unauthorized access. Despite the CVSS vector assigning PR:L (low privileges required), the vulnerability description explicitly reveals a more severe exploitation path: the AJAX handler is registered under the wp_ajax_nopriv_ hook, and the required nonce is broadcast to all site visitors via wp_localize_script on any page rendering the [alba_board] shortcode - enabling fully unauthenticated access to private alba_card records including titles, descriptions, assignees, due dates, tags, and comments. No public exploit has been identified at time of analysis and this CVE is not listed in the CISA KEV catalog, though the vulnerable code path is publicly browsable in the WordPress plugin repository.

Technical ContextAI

Alba Board (CPE: cpe:2.3:a:alejo30:alba_board:*:*:*:*:*:*:*:*) is a WordPress project management plugin implementing kanban-style boards. The vulnerability is rooted in CWE-862 (Missing Authorization): the file includes/ajax-card-details.php registers its AJAX handler using the wp_ajax_nopriv_ hook (lines 12 and 20 across multiple tagged versions), which WordPress routes to unauthenticated callers - the plugin's intent was apparently to restrict this to Editors and Administrators, but the hook selection negates that. Compounding the flaw, the AJAX nonce - normally a CSRF defense that doubles as a capability gate in poorly designed plugins - is pushed to every page visitor through wp_localize_script wherever the [alba_board] shortcode is rendered. Any visitor can harvest this nonce from page source and replay it against the AJAX endpoint without authentication, bypassing the authorization check entirely. The vulnerability spans at least plugin tags 1.1.0, 2.1.0, and trunk through 2.1.3 as confirmed by the plugin repository browser references.

RemediationAI

An upstream fix has been committed to the plugin repository via changeset 3551180 (https://plugins.trac.wordpress.org/changeset?reponame=&old=3551180%40alba-board&new=3551180%40alba-board); however, a specific released patched version number is not confirmed from the available data - verify through the WordPress plugin directory or Wordfence advisory at https://www.wordfence.com/threat-intel/vulnerabilities/id/efe57241-2bb3-41d1-8638-b69ceaff0b4f before upgrading to confirm a patched release is available. As an immediate compensating control, administrators should remove or restrict access to any WordPress pages containing the [alba_board] shortcode, which prevents the nonce from being exposed to unauthenticated visitors and eliminates the exploitation prerequisite - note this disables the board's frontend visibility as a trade-off. If the plugin cannot be updated or deactivated, network-level WAF rules blocking AJAX requests to wp-admin/admin-ajax.php with the specific action parameter associated with the card-details handler can reduce exposure, though this requires identifying the exact action name from the source. Wordfence users should ensure firewall rules for this CVE are active.