FluentBoards CVE-2026-89331

Exploitation requires that a FluentBoards board has been shared via the plugin's public, token-shared board feature; against such a shared board, an unauthenticated remote attacker can request member data and receive the members' email addresses (typically including administrators). The limiting factor is that only boards actively exposed through public token sharing are affected - boards that are not publicly shared do not leak data - so the realistic attack surface is confined to sites using the share-link feature on FluentBoards versions 1.95 through before 2.1.0. No authentication, user interaction, or non-default server settings beyond enabling board sharing are needed.

All signals point to a genuine but low-to-moderate priority information-disclosure issue rather than a critical exposure. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N, base 5.3) is internally consistent with the description: a network-reachable, unauthenticated, low-complexity read of member email addresses, with only confidentiality impact (C:L) and no integrity or availability effect. No EPSS score, no CISA KEV listing, and no public POC are present in the provided data, so there is no evidence of active or automated exploitation - this is a targeted-value leak (harvesting admin/member emails for phishing or credential-stuffing target lists), not a widespread mass-exploitation candidate. The one caveat limiting real-world exposure is that the leak only occurs through the plugin's public token-shared board feature, meaning a board must actually be shared via a public token link for the disclosure to trigger; that gate is not reflected in the AC:L rating but materially narrows the affected population. No conflicting signals across sources: WPScan (reporter), NVD, and EUVD agree on scope and the 5.3 rating.

An attacker discovers or is given a FluentBoards public token-share link for a board and requests the shared board's member data without authenticating; the response includes the email addresses of the board's members, which typically include the site's administrators. The attacker uses the harvested admin emails to craft targeted phishing or credential-stuffing attacks. No public exploit code is identified at time of analysis, and exploitation requires low complexity once a shared-board token/link is known.