EUVD-2026-65298
GHSA-4fw5-p7gj-mc87
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Network-reachable endpoint requires only a Subscriber account (PR:L); IDOR enables integrity modification only, with no confidentiality or availability impact.
Primary rating from Vendor (Wordfence).
CVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Lifecycle Timeline
2DescriptionNVD
The Fluent Boards Pro plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 2.0.11 due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with Subscriber-level access and above, to perform an unauthorized action.
AnalysisAI
Insecure Direct Object Reference in Fluent Boards Pro WordPress plugin (all versions through 2.0.11) enables authenticated attackers with Subscriber-level access to perform unauthorized actions by supplying arbitrary user-controlled object keys that the plugin accepts without ownership validation. The CVSS 4.3 Medium rating reflects network accessibility offset by the authentication prerequisite and limited integrity-only impact. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | A minimum Subscriber-level WordPress account on the target installation is required, as confirmed by PR:L in the CVSS vector - unauthenticated exploitation is not possible. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.3 Medium score is an accurate representation of real-world risk: the flaw is network-accessible with low attack complexity, but the Subscriber-level authentication requirement (PR:L) is a meaningful barrier - exploiting this requires holding a valid WordPress account on the target site. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker registers a free Subscriber-level account on a WordPress site running Fluent Boards Pro ≤ 2.0.11, then enumerates object identifiers (board, task, or card IDs) belonging to other users and submits crafted plugin requests referencing those IDs. Because the server skips ownership validation, the unauthorized modification is applied to the victim's project data. … |
| Remediation | The primary fix is to update Fluent Boards Pro to the version released after 2.0.11; however, no specific patched version number is confirmed in the available source intelligence - administrators must verify the current patched release via the vendor advisory at https://fluentboards.com/ and the Wordfence entry at https://www.wordfence.com/threat-intel/vulnerabilities/id/bec19d80-ba51-4ff8-a111-c2e45928fb51?source=cve. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Fluent Boards Pro
View allArbitrary file upload in the Fluent Boards Pro WordPress plugin (versions 2.0.11 and earlier) lets a user holding the Ed
PHP Object Injection in the Fluent Boards Pro WordPress plugin (versions 2.0.11 and earlier) allows authenticated admini
Arbitrary file deletion in Fluent Boards Pro (WordPress plugin) versions up to and including 2.0.11 allows authenticated
Stored Cross-Site Scripting in Fluent Boards Pro (WordPress plugin by WP Manage Ninja) versions up to and including 2.0.
Insecure Direct Object Reference (IDOR) in Fluent Boards Pro versions up to and including 2.0.11 exposes protected board
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today