EUVD-2026-66938
GHSA-mwvv-pfvv-q922
Severity by source
AV:N/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:H
PR:H reflects required Editor role; I:H added over vendor's I:N because arbitrary file deletion constitutes data destruction impacting integrity; S:C retained as traversal can reach files outside WordPress scope.
Primary rating from Vendor (Patchstack).
CVSS VectorVendor: Patchstack
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:H
Lifecycle Timeline
1DescriptionCVE.org
Editor Arbitrary File Deletion in Fluent Boards Pro <= 2.0.11 versions.
AnalysisAI
Arbitrary file deletion in Fluent Boards Pro (WordPress plugin) versions up to and including 2.0.11 allows authenticated Editor-level users to delete files anywhere on the server via path traversal. The changed scope (S:C in the CVSS vector) indicates that deletion can extend to files outside the WordPress installation - including potentially critical OS-level or application files - causing severe availability impact. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires an authenticated WordPress Editor-level account (or higher) on a site running Fluent Boards Pro 2.0.11 or earlier - this is the specific privilege confirmed by the CVSS PR:H metric. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 base score of 6.8 is driven by network attack vector (AV:N), low complexity (AC:L), changed scope (S:C), and high availability impact (A:H), partially offset by the high privilege requirement (PR:H). … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker with a WordPress Editor account - obtained through credential stuffing, phishing, or insider access - submits a crafted file deletion request to the Fluent Boards Pro editor endpoint, embedding a path traversal sequence (e.g., '../../../../../../etc/passwd' or targeting WordPress configuration files such as wp-config.php). The plugin processes the path without sanitization and deletes the target file, potentially taking the site or server offline. … |
| Remediation | Update Fluent Boards Pro to a version above 2.0.11 as the primary remediation; the Patchstack advisory at https://patchstack.com/database/wordpress/plugin/fluent-boards-pro/vulnerability/wordpress-fluent-boards-pro-plugin-2-0-11-arbitrary-file-deletion-vulnerability?_s_id=cve should be consulted for the exact patched release version, which is not independently confirmed from available input data. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Fluent Boards Pro
View allArbitrary file upload in the Fluent Boards Pro WordPress plugin (versions 2.0.11 and earlier) lets a user holding the Ed
PHP Object Injection in the Fluent Boards Pro WordPress plugin (versions 2.0.11 and earlier) allows authenticated admini
Stored Cross-Site Scripting in Fluent Boards Pro (WordPress plugin by WP Manage Ninja) versions up to and including 2.0.
Insecure Direct Object Reference (IDOR) in Fluent Boards Pro versions up to and including 2.0.11 exposes protected board
Insecure Direct Object Reference in Fluent Boards Pro WordPress plugin (all versions through 2.0.11) enables authenticat
Same weakness CWE-22 – Path Traversal
View allSame technique Path Traversal
View allShare
External POC / Exploit Code
Leaving vuln.today