CVE-2026-85349
MediumCVSS 4.3Exploitation Probability (EPSS)
Low risk8th percentile - higher than 8% of all known CVEs
Summary
The FluentBoards WordPress plugin before 2.0.15 does not properly verify authorization when returning the list of boards a user belongs to. This allows any authenticated user, including a Subscriber with no board access, to disclose the private board memberships of arbitrary users by referencing their user ID.
Risk Assessment
The organization is exposed to disclosure of private board membership information, which could compromise data confidentiality and user trust.
Recommendation
It is recommended to update the FluentBoards plugin to version 2.0.15 or later, which fixes authorization verification when returning board lists.
Other vulnerabilities in FluentBoards
See all- CVE-2026-96821Medium
Privilege Escalation vulnerability allowing a Subscriber user to escalate privileges in FluentBoards up to version 2.0.12.
- CVE-2026-89331Medium
The FluentBoards WordPress plugin before 2.1.0 does not properly restrict the member data returned by its public, token-shared board feature. Unauthenticated users can disclose the email addresses of a shared board's members, typically including administrators.
Original NVD description (English source)
The FluentBoards WordPress plugin before 2.0.15 does not properly verify authorization when returning the list of boards a user belongs to, allowing any authenticated user, including a Subscriber with no board access, to disclose the private board memberships of arbitrary users by referencing their user ID.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS