WordPress Plugin Vulnerabilities

FluentBoards 1.95 - 2.0.15 - Unauthenticated Board Member Email Address Disclosure via Public Board Endpoints

Description

The plugin does not properly restrict the member data returned by its public, token-shared board feature, allowing unauthenticated users to disclose the email addresses of a shared board's members, typically including administrators.

Proof of Concept

Affects Plugins

Plugin icon
fluent-boards
Fixed in 2.1.0

References

CVE
CVE-2026-89331

Classification

Type
SENSITIVE DATA DISCLOSURE
OWASP top 10
A3: Sensitive Data Exposure
CWE
CWE-200
CVSS
5.3 (medium)

Miscellaneous

Original Researcher
vuxvinh
Submitter
vuxvinh
Verified
Yes
WPVDB ID
d1aaacdf-7427-411f-b376-999793524a4b

Timeline

Publicly Published
2026-09-21 (about 2 days ago)
Added
2026-09-21 (about 1 day ago)
Last Updated
2026-09-21 (about 1 day ago)

Other

Published
Title
Published
2026-09-16
Title
Nimble Builder <= 3.3.8 - Subscriber+ Non-Public Content Disclosure via sek_get_nimble_content_for_seo_plugins
Published
2026-03-13
Title
Doofinder for WooCommerce < 2.10.14 - Unauthenticated Information Exposure
Published
2024-03-20
Title
Avada < 7.11.7 - Unauthenticated Sensitive Information Exposure via Form Uploads Directory Listing
Published
2024-04-22
Title
Email Customizer for WooCommerce | Drag and Drop Email Templates Builder < 2.6.1 - Information Exposure
Published
2024-01-17
Title
IP2Location Country Blocker < 2.33.4 - Unauthenticated Sensitive Information Exposure via Debug Log File