Fluent Boards Pro CVE-2026-78466

A minimum Subscriber-level WordPress account on the target installation is required, as confirmed by PR:L in the CVSS vector - unauthenticated exploitation is not possible. The Fluent Boards Pro plugin must be installed and active in a version at or below 2.0.11. Sites with open user registration are at elevated risk because any internet user can self-create a qualifying account. Limiting factors: sites without open registration require the attacker to separately obtain valid credentials (via phishing, credential stuffing, or social engineering); the exact object type and unauthorized action are not fully enumerated in available source data and should be confirmed via the Wordfence advisory.

The CVSS 4.3 Medium score is an accurate representation of real-world risk: the flaw is network-accessible with low attack complexity, but the Subscriber-level authentication requirement (PR:L) is a meaningful barrier - exploiting this requires holding a valid WordPress account on the target site. No EPSS data was provided in source intelligence, and CISA KEV status is negative, indicating no confirmed active exploitation. POC availability is unconfirmed. The impact is bounded to I:L with C:N and A:N, meaning attackers cannot directly exfiltrate data or cause downtime via this vector alone. This positions the vulnerability as a routine patch-cycle priority rather than an emergency response item: the primary elevated risk scenario is WordPress installations with open user registration, where any internet user can self-register a Subscriber account and then leverage the IDOR.

An attacker registers a free Subscriber-level account on a WordPress site running Fluent Boards Pro ≤ 2.0.11, then enumerates object identifiers (board, task, or card IDs) belonging to other users and submits crafted plugin requests referencing those IDs. Because the server skips ownership validation, the unauthorized modification is applied to the victim's project data. No public POC has been identified at time of analysis.