WordPress Plugin Vulnerabilities

FluentBoards < 1.95.3 - Subscriber+ Cross-Board Task Disclosure via IDOR

Description

The plugin does not verify that the items selected for a board import operation belong to a board the requesting user is authorized to access, allowing any authenticated user with member access to a single board to copy and read the stages and tasks (including titles, descriptions and file attachments) of any other board on the site.

Proof of Concept

Affects Plugins

Plugin icon
fluent-boards
Fixed in 1.95.3

References

CVE
CVE-2026-14938

Classification

Type
IDOR
OWASP top 10
A5: Broken Access Control
CWE
CWE-639
CVSS
4.3 (medium)

Miscellaneous

Original Researcher
Diogo Pinto
Submitter
Diogo Pinto
Verified
Yes
WPVDB ID
44d91e8d-ad2f-429c-a21e-364b1fc13fdc

Timeline

Publicly Published
2026-07-20 (about 6 days ago)
Added
2026-07-20 (about 6 days ago)
Last Updated
2026-07-20 (about 6 days ago)

Other

Published
Title
Published
2023-07-07
Title
Getnet Argentina para Woocommerce < 0.0.5 - Unauthenticated Authorization Bypass
Published
2025-02-27
Title
Ultra Addons Lite for Elementor < 1.1.9 - Authenticated (Contributor+) Restricted Post Disclosure
Published
2024-04-23
Title
EventPrime – Events Calendar, Bookings and Tickets < 3.5.0 - Subscriber+ Arbitrary booking settings update
Published
2025-10-16
Title
Binary MLM Plan <= 5.0 - Authenticated (Subscriber+) Insecure Direct Object Reference
Published
2025-05-01
Title
Homey - Booking and Rentals WordPress Theme < 2.4.5 - Insecure Direct Object Reference to Authenticated (Subscriber+) Arbitrary User Deletion