4.3
Medium
CVE-2026-85349 The FluentBoards WordPress plugin before 2.0.15 does not properly verify authorization when returning the list of…
Description
The FluentBoards WordPress plugin before 2.0.15 does not properly verify authorization when returning the list of boards a user belongs to, allowing any authenticated user, including a Subscriber with no board access, to disclose the private board memberships of arbitrary users by referencing their user ID.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| FluentBoards 2.0 | earliest → < 2.0.15 | 2.0.15 |
Other CVEs of FluentBoards
The 5 CVEs of FluentBoards →
CVE-2026-89331
The FluentBoards WordPress plugin before 2.1.0 does not properly restrict the member data returned by its public,…
5.3
Medium
CVE-2026-89328
The FluentBoards WordPress plugin before 2.0.15 does not properly verify that a user holds board-manager privileges…
3.8
Low
CVE-2026-89327
The FluentBoards WordPress plugin before 2.0.15 does not verify that a board member submitting a comment is the user…
3.8
Low
CVE-2026-14938
The FluentBoards WordPress plugin before 1.95.3 does not verify that the items selected for a board import operation…
4.3
Medium