CVE-2026-14938 in FluentBoards Plugin
Summary
by MITRE • 08/02/2026
The FluentBoards WordPress plugin before 1.95.3 does not verify that the items selected for a board import operation belong to a board the requesting user is authorized to access, allowing any authenticated user with member access to a single board to copy and read the stages and tasks (including titles, descriptions and file attachments) of any other board on the site.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 08/02/2026
The vulnerability in FluentBoards WordPress plugin affects versions prior to 1.95.3 and represents a critical authorization bypass flaw that undermines the security model of the platform. This issue stems from insufficient access control validation during board import operations, where the system fails to verify whether the items being imported belong to boards that the authenticated user has legitimate access rights to. The flaw allows any authenticated user with member-level access to a single board to exploit the import functionality and gain unauthorized visibility into the complete structure of other boards within the same site, including their stages and tasks.
The technical implementation of this vulnerability demonstrates a classic broken access control pattern where the application trusts user-provided data without proper authorization checks. When an authenticated user initiates an import operation, the system should validate that the user has appropriate permissions to access all referenced boards and their associated data. However, the current implementation omits these validation steps, creating a pathway for privilege escalation through data exfiltration. The affected data includes not only task titles and descriptions but also file attachments, which could contain sensitive information that should remain restricted to authorized users.
The operational impact of this vulnerability extends beyond simple information disclosure, as it enables attackers to gather comprehensive intelligence about other boards within the organization. This reconnaissance capability allows malicious actors to understand the structure and content of various projects, potentially identifying high-value targets or sensitive data repositories. The flaw affects all authenticated users with member access, meaning that even users who should only have limited visibility into specific boards can leverage this vulnerability to access data from multiple boards across the site.
This vulnerability aligns with CWE-285, which addresses improper authorization issues in software systems, and specifically relates to the ATT&CK technique T1078.004 for valid accounts and T1566.002 for spearphishing with a link. The flaw creates an environment where attackers can use legitimate user credentials to access unauthorized data, making detection more challenging as the activity appears to originate from authorized users. Organizations using FluentBoards are particularly vulnerable since the issue affects all boards within a site, not just specific ones.
The recommended mitigation strategy involves implementing proper authorization checks during import operations by validating that users have appropriate permissions for all referenced boards before allowing data access. This includes verifying board ownership and membership relationships against the requesting user's permissions. Additionally, organizations should ensure timely updates to the plugin to version 1.95.3 or later, which contains the necessary security patches. System administrators should also consider implementing monitoring solutions that can detect unusual import patterns or unauthorized data access attempts, particularly for users who are not typically involved in cross-board operations. The fix should incorporate proper input validation and access control mechanisms that enforce the principle of least privilege, ensuring that users can only access data they have explicit authorization to view.