Kanbanz Plugin Broken Access Control in WordPress

Executive Summary

This vulnerability is a broken access control issue in the Kanbanz WordPress plugin before version 1.0.3. It allows authenticated Kanban Staff users to access and modify boards they are not members of by exploiting admin-ajax handlers that fail to call kanbanz_user_can_access_board() or per-task edit checks. Attackers can supply arbitrary board IDs to read sensitive task data, overwrite status columns, subtasks, labels, inject comments, upload or delete attachments, and create tasks or set WIP limits on boards owned by other teams.

Useful 0 Not Useful 0

Detection Guidance

Check WordPress installations for the Kanbanz plugin version 1.0.2 or earlier. Inspect admin-ajax.php requests for unauthorized board_id or task_id parameters. Review server logs for suspicious activity from Kanban Staff users modifying boards they don't own.

Useful 0 Not Useful 0

Impact Analysis

If you use the Kanbanz plugin before version 1.0.3, an attacker with Kanban Staff access could read or modify sensitive task data, alter project workflows, delete attachments, or inject malicious comments. This could disrupt project management, leak confidential information, or corrupt task boards belonging to other teams.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, potentially violating GDPR (data protection) and HIPAA (health information privacy) by exposing personal or health-related task information. Compliance may be impacted if unauthorized modifications or deletions occur, affecting data integrity and audit trails.

Useful 0 Not Useful 0

Mitigation Strategies

Update the Kanbanz plugin to version 1.0.3 or later immediately. Remove unnecessary Kanban Staff user roles. Implement strict input validation for board_id and task_id parameters in admin-ajax handlers. Monitor for unauthorized board access attempts.

Useful 0 Not Useful 0