rootpwn

medium · CVSS v3 5.3 · EPSS 0.00199

CVE-2026-89331

The FluentBoards WordPress plugin (pre‑2.1.0) fails to restrict member data exposed by its public, token‑shared board feature, enabling unau

Overview

The FluentBoards WordPress plugin (pre‑2.1.0) fails to restrict member data exposed by its public, token‑shared board feature, enabling unauthenticated users to retrieve the email addresses of board members, often including administrators. This flaw allows attackers to harvest sensitive contact information without authentication. The vulnerability is a medium‑severity confidentiality breach.

Description

The FluentBoards WordPress plugin before 2.1.0 does not properly restrict the member data returned by its public, token-shared board feature, allowing unauthenticated users to disclose the email addresses of a shared board's members, typically including administrators.

Impact

Confidentiality is compromised as attackers can obtain email addresses of board members, exposing them to phishing or spam. Administrators and other board participants are the primary victims, potentially leading to credential compromise or social engineering attacks.

Remediation

Upgrade the FluentBoards plugin to version 2.1.0 or later, which implements proper access controls for the token‑shared board feature. If an upgrade is not immediately possible, disable the token‑shared board functionality or restrict its usage to trusted users only. Additionally, review and enforce least‑privilege permissions on WordPress user roles.

Risk context

The CVE has a medium severity score (CVSS v3 5.3) and a very low EPSS (0.00199), indicating a moderate risk that is unlikely to be widely exploited. Defenders should still address the issue promptly to prevent potential data leakage.

Affected products

  • FluentBoards 2.0.x
  • WordPress

Scores

Severity
medium
CVSS v2
5
CVSS v3
5.3
CVSS v4
—
EPSS
0.00199

email disclosure WordPress plugin confidentiality FluentBoards unauthenticated moderate risk

← All CVEs

Related CVEs

medium

CVE-2026-88929

The Product Badge, Label, Countdown Timer for WooCommerce WordPress plugin before 7.5.2 does not check whether a product is published before returning its details to unauthenticated users, allowing them to read the title, description and price of draft, pending and private products.

View analysis

medium

CVE-2026-88974

WPGraphQL provides a GraphQL API for WordPress sites. Prior to 2.22.2, the updatePost mutation in src/Mutation/PostObjectUpdate.php checks only the collection-level edit_posts capability and the post author, but does not enforce the object-level edit_post capability or require publish_posts for public status transitions. An authenticated Contributor can therefore publish the Contributor's own draft without editorial approval or modify the Contributor's previously published post despite lacking edit_published_posts, while posts owned by other authors remain protected. This issue is fixed in version 2.22.2.

View analysis

medium

CVE-2026-96807

In Flatpak before 1.18.1, a malicious sandboxed app can replace ~/.var/app/$appid/.ld.so with a symlink, causing regenerate_ld_cache to write files at an arbitrary location. The filenames and content are not attacker controlled, making this hard to exploit.

View analysis

medium

CVE-2026-90985

The WPC Smart Compare for WooCommerce WordPress plugin before 6.6.1 does not apply WordPress's post-password protection when returning product content through its comparison handler, allowing unauthenticated users to read the description of password-protected products.

View analysis