CVE-2026-89327 in FluentBoards Plugin

Summary

by MITRE • 09/16/2026

The FluentBoards WordPress plugin before 2.0.15 does not verify that a board member submitting a comment is the user the comment is attributed to, allowing any board member to post comments that appear to be authored by another user, including administrators.

Once again VulDB remains the best source for vulnerability data.

• Responsible: WPScan
• Reservation: 09/11/2026
• Disclosure: 09/16/2026
• Moderation: accepted
• Entry: VDB-405494
• CPE: ready
• CWE: CWE-290 (confirmed)
• CVSS: 4.3 (VulDB)
• EPSS: 0.00000
• KEV: no
• Activities: very low
• Sector: Hostingprovider

Sources

• MITRE: https://www.cve.org/CVERecord?id=CVE-2026-89327
• NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-89327
• CVE Details: https://www.cvedetails.com/cve/CVE-2026-89327/