CVE-2026-14938
Received Received - Intake

FluentBoards Plugin Unauthorized Board Data Access

Publication date: 2026-08-02

Last updated on: 2026-08-02

Assigner: WPScan

Description
The FluentBoards WordPress plugin before 1.95.3 does not verify that the items selected for a board import operation belong to a board the requesting user is authorized to access, allowing any authenticated user with member access to a single board to copy and read the stages and tasks (including titles, descriptions and file attachments) of any other board on the site.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-02
Last Modified
2026-08-02
Generated
2026-08-02
AI Q&A
2026-08-02
EPSS Evaluated
N/A
NVD
CVE-2026-14938
EUVD
EUVD-2026-51931

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
fluentboards fluentboards to 1.95.3 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in the FluentBoards WordPress plugin before version 1.95.3 allows authenticated users with member access to a single board to read and copy stages, tasks, titles, descriptions, and file attachments from any other board on the site without proper authorization checks.

Detection Guidance

Check if the FluentBoards plugin version is below 1.95.3. Inspect WordPress admin access logs for unauthorized board data access attempts by authenticated users with member access.

Impact Analysis

An attacker with basic user access could access sensitive information from other boards, including confidential tasks or attachments, potentially leading to data leaks or unauthorized data exposure on the WordPress site.

Compliance Impact

This vulnerability could lead to unauthorized access to personal or sensitive data, violating GDPR's data protection principles or HIPAA's requirements for safeguarding protected health information, depending on the data processed by the boards.

Mitigation Strategies

Update the FluentBoards plugin to version 1.95.3 or later. Review and restrict member access permissions to only necessary boards. Monitor for unusual board data access or export activities.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-14938. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart