EUVD-2026-66937
GHSA-w7r6-phvj-8m3c
Severity by source
AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
Network-reachable upload handler needs an Editor-level account (PR:H) but no interaction; file-upload-to-RCE crosses into the OS/security boundary (S:C) with full C/I/A impact.
Primary rating from Vendor (Patchstack).
CVSS VectorVendor: Patchstack
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
Lifecycle Timeline
2DescriptionCVE.org
Editor Arbitrary File Upload in Fluent Boards Pro <= 2.0.11 versions.
AnalysisAI
Arbitrary file upload in the Fluent Boards Pro WordPress plugin (versions 2.0.11 and earlier) lets a user holding the Editor role (or higher) upload files of dangerous types, typically leading to web shell placement and remote code execution on the host. The flaw carries a CVSS 9.1 rating driven by a scope-changed, full-CIA-impact chain, but requires an authenticated privileged account. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires an authenticated WordPress account with the Editor role or higher (CVSS PR:H), reachable over the network with no user interaction and low complexity. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 vector (AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H) shows a network-reachable, low-complexity flaw with high confidentiality, integrity, and availability impact and a scope change - consistent with upload-to-RCE. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker who has obtained or been granted an Editor account logs into the WordPress admin and uses the Fluent Boards Pro upload feature to submit a PHP web shell disguised as a permitted file type. The plugin stores it in a web-reachable path, and the attacker then requests that URL to execute commands on the server. … |
| Remediation | Upgrade Fluent Boards Pro to a fixed release above 2.0.11 as soon as the vendor publishes one; no exact fix version is confirmed in the available data, so consult the Patchstack advisory (https://patchstack.com/database/wordpress/plugin/fluent-boards-pro/vulnerability/wordpress-fluent-boards-pro-plugin-2-0-11-arbitrary-file-upload-vulnerability?_s_id=cve) and the vendor changelog for the patched version number before deploying. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: inventory all WordPress instances using Fluent Boards Pro version 2.0.11 or earlier and immediately disable the plugin on affected servers, or restrict Editor role access to only essential administrative staff with demonstrated need. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Fluent Boards Pro
View allPHP Object Injection in the Fluent Boards Pro WordPress plugin (versions 2.0.11 and earlier) allows authenticated admini
Arbitrary file deletion in Fluent Boards Pro (WordPress plugin) versions up to and including 2.0.11 allows authenticated
Stored Cross-Site Scripting in Fluent Boards Pro (WordPress plugin by WP Manage Ninja) versions up to and including 2.0.
Insecure Direct Object Reference (IDOR) in Fluent Boards Pro versions up to and including 2.0.11 exposes protected board
Insecure Direct Object Reference in Fluent Boards Pro WordPress plugin (all versions through 2.0.11) enables authenticat
Same technique File Upload
View allShare
External POC / Exploit Code
Leaving vuln.today