WordPress Plugin Vulnerabilities

KBoard < 6.7 - Unauthenticated Board Media Deletion via IDOR

Description

The plugin does not verify ownership or context before deleting board media, allowing unauthenticated attackers to permanently delete its uploaded media files and their database records by iterating identifiers.

Proof of Concept

Affects Plugins

Plugin icon
kboard
Fixed in 6.7

References

CVE
CVE-2026-88910

Classification

Type
IDOR
OWASP top 10
A5: Broken Access Control
CWE
CWE-639
CVSS
5.3 (medium)

Miscellaneous

Original Researcher
SeongJun Joo
Submitter
SeongJun Joo
Verified
Yes
WPVDB ID
96119ba5-4dcd-4aff-adf9-83f058c3dc6d

Timeline

Publicly Published
2026-09-14 (about 2 days ago)
Added
2026-09-14 (about 1 day ago)
Last Updated
2026-09-14 (about 1 day ago)

Other

Published
Title
Published
2025-11-10
Title
The Total Book Project < 1.1 - Insecure Direct Object Reference to Authenticated (Contributor+) Book Manipulation
Published
2025-07-08
Title
Support Board < 3.8.1 - Unauthenticated Authorization Bypass due to Use of Default Secret Key
Published
2025-04-30
Title
WordPress Simple PayPal Shopping Cart < 5.1.4 - Insecure Direct Object Reference
Published
2026-04-06
Title
Amelia < 2.2 - Insecure Direct Object Reference to Authenticated (Employee+) Privilege Escalation via 'externalId' Parameter
Published
2024-08-12
Title
Masteriyo - LMS < 1.11.5 - Authenticated (Student+) Insecure Direct Object Reference