Fluent Boards Pro CVE-2026-78278

The target WordPress installation must have Fluent Boards Pro version 2.0.11 or earlier installed and active. Based on the 'Subscriber' qualifier in the vulnerability title, exploitation most likely requires at minimum a Subscriber-level WordPress account on the target site - meaning the attacker must either self-register (if open registration is enabled) or possess stolen or legitimately issued credentials. The CVSS vector PR:N conflicts with this interpretation; if PR:N is accurate, unauthenticated exploitation against any exposed WordPress REST API or AJAX endpoint is possible. Open user registration (a non-default but common WordPress configuration for membership or client-portal sites) would expand the exploitable population. Exploitation is limited to read-only confidentiality impact - no write, delete, or code-execution capability is indicated. No special server configuration or feature flag beyond plugin activation is required.

The CVSS base score of 5.3 (Medium) reflects a network-reachable, low-complexity confidentiality impact with no privileges required (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N). However, the vulnerability title explicitly names 'Subscriber' as the exploitation context, which in WordPress terminology denotes authenticated low-privilege users - this conflicts with the PR:N metric and warrants verification against the vendor or Patchstack's detailed write-up. No EPSS score was provided in the input data, so probabilistic exploitation likelihood cannot be quantified. The absence of a KEV listing and no reported POC means this is currently a theoretical-to-opportunistic risk, not a confirmed active-exploitation scenario. No SSVC decision data was supplied. Real-world impact is bounded by the confidentiality-only scope (I:N, A:N), limiting blast radius to information disclosure rather than system compromise. Organizations running Fluent Boards Pro in environments where boards contain sensitive project data - financial plans, HR tasks, client deliverables - face meaningful data leakage risk even from a single compromised or rogue subscriber account.

An attacker registers or already holds a Subscriber-level WordPress account on a site running Fluent Boards Pro 2.0.11 or earlier. They issue HTTP requests to the plugin's board or task retrieval endpoint, substituting object IDs they do not own - iterating through sequential integers or GUIDs - and receive data from boards belonging to other users. No public exploit code has been identified at time of analysis, but the low attack complexity means manual enumeration requires no special tooling.