FluentBoards EUVD-2026-89874

Requires a valid authenticated account at Subscriber (low-privilege) level on a WordPress site running the FluentBoards plugin version 2.0.12 or earlier; this is readily met where the site permits open user registration. Exploitation is remote over the network with no user interaction and low attack complexity. Limiting factors: the attacker must already be authenticated (PR:L), the site must run a vulnerable version (<= 2.0.12) with the plugin active, and impacts are bounded to Low confidentiality/integrity/availability within the plugin's data. Sites that disable self-registration or have upgraded past 2.0.12 are not exposed.

This is a genuine but moderate-priority issue rather than a high-urgency one. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L, score 6.3) describes a network-reachable, low-complexity flaw exploitable by an already-authenticated low-privilege user (PR:L, consistent with the 'Subscriber' role named in the description) with no user interaction. The impacts are all Low across confidentiality, integrity, and availability, and scope is Unchanged, which caps the severity in the Medium band. No EPSS score, no CISA KEV listing, and no public proof-of-concept were provided, so there is no public exploit identified at time of analysis and no evidence of active exploitation. The primary risk driver is CWE-266 (Improper Privilege Management): a Subscriber escalating privileges within a project-management/kanban plugin could gain access to boards, tasks, or capabilities they should not hold. The main mitigating factors are the authentication requirement (attacker must already hold a valid low-privilege account) and the fact that a patch exists in versions after 2.0.12. No data is strongly conflicting; the CVSS vector and the description agree on a network-based, low-privilege privilege-escalation scenario.

An attacker registers or obtains a low-privilege (Subscriber) account on a WordPress site running FluentBoards <= 2.0.12 - trivial where open registration is enabled. They then invoke a plugin action that fails to properly enforce role/capability checks, elevating their effective privileges to access or manipulate boards, tasks, and data beyond their assigned role. No user interaction is required and the attack is fully remote over the network; no public PoC was identified at time of analysis.