CVE-2026-78275
MediumCVSS 6.8Exploitation Probability (EPSS)
Low risk41th percentile - higher than 41% of all known CVEs
Summary
The Fluent Boards Pro plugin version 2.0.11 and earlier has an Editor Arbitrary File Deletion vulnerability. An editor can delete arbitrary files on the server, which can lead to serious damage.
Risk Assessment
An attacker with editor role can delete critical system files or data, potentially causing service unavailability and data loss.
Recommendation
Update Fluent Boards Pro to the latest patched version and restrict editor permissions to the minimum.
Other vulnerabilities in Fluent Boards Pro
See all- CVE-2026-78278Medium
IDOR vulnerability in Fluent Boards Pro versions up to 2.0.11, affecting subscriber role users. Allows access to unauthorized objects.
- CVE-2026-78274Critical
The Fluent Boards Pro plugin versions up to 2.0.11 contain an arbitrary file upload vulnerability exploitable by users with the editor role. This can lead to execution of malicious code on the server.
- CVE-2026-78276High
Editor PHP Object Injection vulnerability in Fluent Boards Pro versions up to 2.0.11. A user with editor role can inject malicious PHP objects, potentially leading to remote code execution.
- CVE-2026-78273Medium
The Fluent Boards Pro plugin version 2.0.11 and earlier has a Subscriber Cross Site Scripting (XSS) vulnerability. A user with the subscriber role can inject a malicious script that executes in other users' browsers.
- CVE-2026-78466Medium
The Fluent Boards Pro plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 2.0.11 due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with Subscriber-level access and above, to perform an unauthorized action.
Original NVD description (English source)
Editor Arbitrary File Deletion in Fluent Boards Pro <= 2.0.11 versions.