CVE-2026-109696
MediumCVSS 5.4Exploitation Probability (EPSS)
Low risk3th percentile - higher than 3% of all known CVEs
Summary
Missing Authorization vulnerability in WP ManageNinja LLC FluentBoards fluent-boards allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects FluentBoards: from n/a through 2.1.0.
Risk Assessment
An unauthenticated or low-privileged user may perform actions reserved for higher privileges, potentially leading to data modification or privilege escalation. This affects the confidentiality and integrity of the WordPress site.
Recommendation
Update the FluentBoards plugin to a version newer than 2.1.0. Verify role permissions and check logs for unauthorized actions.
Other vulnerabilities in FluentBoards
See all- CVE-2026-96821Medium
Privilege Escalation vulnerability allowing a Subscriber user to escalate privileges in FluentBoards up to version 2.0.12.
- CVE-2026-89331Medium
The FluentBoards WordPress plugin before 2.1.0 does not properly restrict the member data returned by its public, token-shared board feature. Unauthenticated users can disclose the email addresses of a shared board's members, typically including administrators.
- CVE-2026-85349Medium
The FluentBoards WordPress plugin before 2.0.15 does not properly verify authorization when returning the list of boards a user belongs to. This allows any authenticated user, including a Subscriber with no board access, to disclose the private board memberships of arbitrary users by referencing their user ID.
Original NVD description (English source)
Missing Authorization vulnerability in WP ManageNinja LLC FluentBoards fluent-boards allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects FluentBoards: from n/a through 2.1.0.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS