{"id":"CVE-2026-14938","aliases":["EUVD-2026-51931","GHSA-66hj-2rxc-44vr"],"status":"published","title":"FluentBoards \u003c 1.95.3 - Subscriber+ Cross-Board Task Disclosure via IDOR","description":"The FluentBoards  WordPress plugin before 1.95.3 does not verify that the items selected for a board import operation belong to a board the requesting user is authorized to access, allowing any authenticated user with member access to a single board to copy and read the stages and tasks (including titles, descriptions and file attachments) of any other board on the site.","severity":{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","level":"medium","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-10","score":0.0027,"percentile":0.19401,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-639"],"published":"2026-08-02T06:00:08Z","modified":"2026-08-26T16:31:36Z","products":[{"vendor":"mahmudul hasan arif","product":"fluentboards"},{"vendor":"unknown","product":"fluentboards"}],"references":[{"url":"https://wpscan.com/vulnerability/44d91e8d-ad2f-429c-a21e-364b1fc13fdc/","tags":["exploit","vdb-entry","technical-description"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-14938"},{"url":"https://wpscan.com/vulnerability/44d91e8d-ad2f-429c-a21e-364b1fc13fdc"},{"url":"https://github.com/advisories/GHSA-66hj-2rxc-44vr"}],"sources":{"cve":[{"id":"CVE-2026-14938","title":"FluentBoards \u003c 1.95.3 - Subscriber+ Cross-Board Task Disclosure via IDOR","description":"The FluentBoards  WordPress plugin before 1.95.3 does not verify that the items selected for a board import operation belong to a board the requesting user is authorized to access, allowing any authenticated user with member access to a single board to copy and read the stages and tasks (including titles, descriptions and file attachments) of any other board on the site.","status":"published","published":"2026-08-02T06:00:08.505Z","modified":"2026-08-05T16:18:20.534Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","level":"medium","assessor":"adp"}],"cwes":["CWE-639"],"updated_at":"2026-11-02T13:38:43.260938Z"}],"euvd":[{"id":"EUVD-2026-51931","description":"The FluentBoards  WordPress plugin before 1.95.3 does not verify that the items selected for a board import operation belong to a board the requesting user is authorized to access, allowing any authenticated user with member access to a single board to copy and read the stages and tasks (including titles, descriptions and file attachments) of any other board on the site.","status":"published","published":"2026-08-02T06:00:08Z","modified":"2026-08-05T16:18:20Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T18:02:09.87889Z"}],"ghsa":[{"id":"GHSA-66hj-2rxc-44vr","title":"The FluentBoards  WordPress plugin before 1.95.3 does not verify that the items selected for a...","description":"The FluentBoards  WordPress plugin before 1.95.3 does not verify that the items selected for a board import operation belong to a board the requesting user is authorized to access, allowing any authenticated user with member access to a single board to copy and read the stages and tasks (including titles, descriptions and file attachments) of any other board on the site.","status":"published","published":"2026-08-02T06:30:21Z","modified":"2026-08-05T18:31:29Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","level":"medium"}],"cwes":["CWE-639"],"updated_at":"2026-11-02T15:10:07.328501Z"}],"nvd":[{"id":"CVE-2026-14938","description":"The FluentBoards  WordPress plugin before 1.95.3 does not verify that the items selected for a board import operation belong to a board the requesting user is authorized to access, allowing any authenticated user with member access to a single board to copy and read the stages and tasks (including titles, descriptions and file attachments) of any other board on the site.","status":"published","published":"2026-08-02T06:16:35.947Z","modified":"2026-08-26T16:31:36.75Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","level":"medium","assessor":"secondary"}],"cwes":["CWE-639"],"updated_at":"2026-11-02T14:12:34.290716Z"}]}}