CVE-2026-85349 in FluentBoards Plugin
Summary
by MITRE • 09/16/2026
The FluentBoards WordPress plugin before 2.0.15 does not properly verify authorization when returning the list of boards a user belongs to, allowing any authenticated user, including a Subscriber with no board access, to disclose the private board memberships of arbitrary users by referencing their user ID.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 09/16/2026
The vulnerability identified in FluentBoards versions prior to 2.0.15 represents a critical failure in server-side authorization controls within the WordPress plugin ecosystem. This flaw specifically affects the API endpoint responsible for retrieving the list of boards associated with a specific user account. In secure software architecture, any request that returns sensitive data related to one entity must strictly validate that the requesting actor has explicit permission to access that particular resource. However, in this implementation, the application logic relies on insufficient checks when processing requests to fetch board membership lists. The system fails to verify whether the authenticated user making the API call is actually authorized to view the details of the target user's private boards. This oversight creates a direct path for unauthorized data disclosure, as the server processes the request based solely on the presence of valid authentication credentials rather than verifying granular permissions relative to the requested resource.
From a technical perspective, this vulnerability allows any authenticated WordPress user, regardless of their assigned role or capability level, to enumerate private board memberships. Even users with the lowest privilege tier, such as Subscribers who typically have no access to administrative features or project management tools, can exploit this flaw. By manipulating the user ID parameter in the API request, an attacker can iterate through valid WordPress user IDs and retrieve a comprehensive list of boards that each target user is part of. This capability effectively bypasses the intended isolation between users within the application. The vulnerability stems from a lack of object-level authorization checks, where the system trusts the input provided by the client without cross-referencing it against the permissions matrix defined for the authenticated session.
The operational impact of this flaw extends beyond simple data leakage. While board memberships themselves may not contain highly sensitive personal information in all contexts, they reveal significant organizational structure and project involvement details. Attackers can use this intelligence to map out internal team structures, identify key personnel involved in specific projects, or pinpoint high-value targets for further social engineering attacks. In environments where FluentBoards is used for confidential business planning or client work, the exposure of which users are associated with which boards constitutes a breach of confidentiality. This information could be leveraged by competitors to infer strategic directions or by malicious actors to tailor phishing campaigns against specific individuals based on their project responsibilities and team affiliations.
This vulnerability aligns closely with CWE-284, Improper Access Control, as it involves the failure to enforce proper restrictions on an authenticated user's ability to access data associated with other users. Furthermore, from a tactical standpoint within the MITRE ATT&CK framework, this behavior facilitates Reconnaissance activities, specifically under techniques related to Account Enumeration and Discovery of Web Applications. The attacker gains valuable intelligence about the target organization without needing elevated privileges or exploiting complex code execution flaws, relying instead on broken access control logic that is prevalent in many web applications when developers fail to implement robust authorization checks for every API endpoint.
To mitigate this vulnerability, administrators must immediately update FluentBoards to version 2.0.15 or later, where the developer has addressed these authorization gaps by implementing strict object-level permission verification. Until an upgrade is feasible, it is advisable to restrict access to WordPress user registration if possible and monitor logs for unusual patterns of API requests targeting multiple user IDs in rapid succession. Additionally, organizations should review their overall plugin security posture, ensuring that all installed plugins are kept up to date with the latest patches from their respective developers. Regular security audits focusing on authorization logic can help prevent similar issues where authentication is present but proper access control is absent.