EUVD-2026-80195
GHSA-7f4v-rw2p-hvrp
Lifecycle Timeline
2DescriptionCVE.org
The FluentBoards WordPress plugin before 2.0.15 does not properly verify authorization when returning the list of boards a user belongs to, allowing any authenticated user, including a Subscriber with no board access, to disclose the private board memberships of arbitrary users by referencing their user ID.
Analysis
The FluentBoards WordPress plugin before 2.0.15 does not properly verify authorization when returning the list of boards a user belongs to, allowing any authenticated user, including a Subscriber with no board access, to disclose the private board memberships of arbitrary users by referencing their user ID.
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Fluentboards
View allInsecure Direct Object Reference in FluentBoards WordPress plugin before 1.95.3 allows any authenticated user holding me
Authorization bypass in FluentBoards up to 1.91.2 allows authenticated users to access and modify board data belonging t
The FluentBoards WordPress plugin before 2.0.15 does not properly verify that a user holds board-manager privileges bef
The FluentBoards WordPress plugin before 2.0.15 does not verify that a board member submitting a comment is the user th
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today