CVE-2026-89331
MediumCVSS 5.3Exploitation Probability (EPSS)
Low risk9th percentile - higher than 9% of all known CVEs
Summary
The FluentBoards WordPress plugin before 2.1.0 does not properly restrict the member data returned by its public, token-shared board feature. Unauthenticated users can disclose the email addresses of a shared board's members, typically including administrators.
Risk Assessment
The email address leak can be used for phishing and social engineering attacks targeting administrators. This violates privacy and increases the risk of further attacks.
Recommendation
Update the FluentBoards plugin to version 2.1.0 or later. Consider invalidating public board sharing tokens.
Other vulnerabilities in FluentBoards
See all- CVE-2026-96821Medium
Privilege Escalation vulnerability allowing a Subscriber user to escalate privileges in FluentBoards up to version 2.0.12.
- CVE-2026-85349Medium
The FluentBoards WordPress plugin before 2.0.15 does not properly verify authorization when returning the list of boards a user belongs to. This allows any authenticated user, including a Subscriber with no board access, to disclose the private board memberships of arbitrary users by referencing their user ID.
Original NVD description (English source)
The FluentBoards WordPress plugin before 2.1.0 does not properly restrict the member data returned by its public, token-shared board feature, allowing unauthenticated users to disclose the email addresses of a shared board's members, typically including administrators.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS