CVE-2026-96821
MediumCVSS 6.3Summary
Privilege Escalation vulnerability allowing a Subscriber user to escalate privileges in FluentBoards up to version 2.0.12.
Risk Assessment
An attacker can gain administrator privileges, leading to full site compromise.
Recommendation
Update the plugin to the latest version that includes the fix.
Other vulnerabilities in FluentBoards
See all- CVE-2026-89331Medium
The FluentBoards WordPress plugin before 2.1.0 does not properly restrict the member data returned by its public, token-shared board feature. Unauthenticated users can disclose the email addresses of a shared board's members, typically including administrators.
- CVE-2026-85349Medium
The FluentBoards WordPress plugin before 2.0.15 does not properly verify authorization when returning the list of boards a user belongs to. This allows any authenticated user, including a Subscriber with no board access, to disclose the private board memberships of arbitrary users by referencing their user ID.
Original NVD description (English source)
Subscriber Privilege Escalation in FluentBoards <= 2.0.12 versions.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS