EUVD-2026-65298
GHSA-4fw5-p7gj-mc87
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessRegister or obtain Subscriber-level WordPress account
-
DeliveryEnumerate target object references (board/task IDs) via plugin endpoints
-
ExploitCraft request substituting victim's object key
-
ExecutionSubmit to vulnerable AJAX or REST endpoint
-
PersistPlugin processes action without ownership check
-
ImpactUnauthorized modification applied to victim's data
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Object-level authorization, IDOR prevention
|
| Exploitation Conditions | A minimum Subscriber-level WordPress account on the target installation is required, as confirmed by PR:L in the CVSS vector - unauthenticated exploitation is not possible. The Fluent Boards Pro plugin must be installed and active in a version at or below 2.0.11. Sites with open user registration are at elevated risk because any internet user can self-create a qualifying account. Limiting factors: sites without open registration require the attacker to separately obtain valid credentials (via phishing, credential stuffing, or social engineering); the exact object type and unauthorized action are not fully enumerated in available source data and should be confirmed via the Wordfence advisory. |
| Impact | The CVSS 4.3 Medium score is an accurate representation of real-world risk: the flaw is network-accessible with low attack complexity, but the Subscriber-level authentication requirement (PR:L) is a meaningful barrier - exploiting this requires holding a valid WordPress account on the target site. No EPSS data was provided in source intelligence, and CISA KEV status is negative, indicating no confirmed active exploitation. POC availability is unconfirmed. The impact is bounded to I:L with C:N and A:N, meaning attackers cannot directly exfiltrate data or cause downtime via this vector alone. This positions the vulnerability as a routine patch-cycle priority rather than an emergency response item: the primary elevated risk scenario is WordPress installations with open user registration, where any internet user can self-register a Subscriber account and then leverage the IDOR. |
| Exploit ScenarioDerived | An attacker registers a free Subscriber-level account on a WordPress site running Fluent Boards Pro ≤ 2.0.11, then enumerates object identifiers (board, task, or card IDs) belonging to other users and submits crafted plugin requests referencing those IDs. Because the server skips ownership validation, the unauthorized modification is applied to the victim's project data. No public POC has been identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Aug 25, 2026
Insecure Direct Object Reference in Fluent Boards Pro WordPress plugin (all versions through 2.0.11) enables authenticated attackers with Subscriber-level access to perform unauthorized actions by supplying arbitrary user-controlled object keys that the plugin accepts without ownership validation. The CVSS 4.3 Medium rating reflects network accessibility offset by the authentication prerequisite and limited integrity-only impact. No public exploit code or active exploitation via CISA KEV has been identified at time of analysis.
RemediationAI
The primary fix is to update Fluent Boards Pro to the version released after 2.0.11; however, no specific patched version number is confirmed in the available source intelligence - administrators must verify the current patched release via the vendor advisory at https://fluentboards.com/ and the Wordfence entry at https://www.wordfence.com/threat-intel/vulnerabilities/id/bec19d80-ba51-4ff8-a111-c2e45928fb51?source=cve. As an interim compensating control, disable open WordPress user registration (Settings > General > uncheck 'Anyone can register') to prevent unauthenticated users from self-enrolling as Subscribers; this meaningfully reduces the exploitable population to already-trusted accounts. Additionally, audit existing Subscriber-level accounts for unauthorized or suspicious registrations. No further workarounds are documented in available intelligence.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Fluent Boards Pro is a WordPress project management plugin, identified by CPE cpe:2.3:a:fluent_boars:fluent_boards_pro. The root cause is CWE-639 (Authorization Bypass Through User-Controlled Key): the application accepts a user-supplied identifier - such as a board, task, or card ID - to locate and act on a resource without verifying that the requesting user owns or is authorized to access that specific object. In WordPress plugins this pattern typically manifests in AJAX handlers or REST API endpoints where integer object IDs are passed as POST parameters. The CVSS vector AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N confirms the endpoint is reachable over the network with no interaction required beyond holding a low-privilege account, and that the impact is confined to unauthorized data modification with no confidentiality or availability consequences.
Know when Fluent Boards Pro gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Network-reachable endpoint requires only a Subscriber account (PR:L); IDOR enables integrity modification only, with no confidentiality or availability impact.
Primary rating from Vendor (Wordfence).
CVSS VectorNVD
DescriptionNVD
The Fluent Boards Pro plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 2.0.11 due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with Subscriber-level access and above, to perform an unauthorized action.
Threat Intelligence Overview
NVD
CVE.org
EPSS
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
More in Fluent Boards Pro
View allArbitrary file upload in the Fluent Boards Pro WordPress plugin (versions 2.0.11 and earlier) lets a user holding the Ed
PHP Object Injection in the Fluent Boards Pro WordPress plugin (versions 2.0.11 and earlier) allows authenticated admini
Arbitrary file deletion in Fluent Boards Pro (WordPress plugin) versions up to and including 2.0.11 allows authenticated
Stored Cross-Site Scripting in Fluent Boards Pro (WordPress plugin by WP Manage Ninja) versions up to and including 2.0.
Insecure Direct Object Reference (IDOR) in Fluent Boards Pro versions up to and including 2.0.11 exposes protected board
Exploit-DB