CVE-2026-78278
MediumCVSS 5.3Exploitation Probability (EPSS)
Low risk22th percentile - higher than 22% of all known CVEs
Summary
IDOR vulnerability in Fluent Boards Pro versions up to 2.0.11, affecting subscriber role users. Allows access to unauthorized objects.
Risk Assessment
Risk of disclosure or modification of other users' data, potentially leading to confidentiality and integrity breach.
Recommendation
Update the Fluent Boards Pro plugin to the latest version that includes the fix.
Other vulnerabilities in Fluent Boards Pro
See all- CVE-2026-78274Critical
The Fluent Boards Pro plugin versions up to 2.0.11 contain an arbitrary file upload vulnerability exploitable by users with the editor role. This can lead to execution of malicious code on the server.
- CVE-2026-78276High
Editor PHP Object Injection vulnerability in Fluent Boards Pro versions up to 2.0.11. A user with editor role can inject malicious PHP objects, potentially leading to remote code execution.
- CVE-2026-78275Medium
The Fluent Boards Pro plugin version 2.0.11 and earlier has an Editor Arbitrary File Deletion vulnerability. An editor can delete arbitrary files on the server, which can lead to serious damage.
- CVE-2026-78273Medium
The Fluent Boards Pro plugin version 2.0.11 and earlier has a Subscriber Cross Site Scripting (XSS) vulnerability. A user with the subscriber role can inject a malicious script that executes in other users' browsers.
Original NVD description (English source)
Subscriber Insecure Direct Object References (IDOR) in Fluent Boards Pro <= 2.0.11 versions.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS