FluentBoards vulnerabilities

Privilege Escalation vulnerability allowing a Subscriber user to escalate privileges in FluentBoards up to version 2.0.12.

The FluentBoards WordPress plugin before 2.1.0 does not properly restrict the member data returned by its public, token-shared board feature. Unauthenticated users can disclose the email addresses of a shared board's members, typically including administrators.

The FluentBoards WordPress plugin before 2.0.15 does not properly verify authorization when returning the list of boards a user belongs to. This allows any authenticated user, including a Subscriber with no board access, to disclose the private board memberships of arbitrary users by referencing their user ID.