CVE-2026-89331
Deferred Deferred - Pending Action

Unauthenticated Email Disclosure in FluentBoards WordPress Plugin

Publication date: 2026-09-23

Last updated on: 2026-09-23

Assigner: WPScan

Description
The FluentBoards WordPress plugin before 2.1.0 does not properly restrict the member data returned by its public, token-shared board feature, allowing unauthenticated users to disclose the email addresses of a shared board's members, typically including administrators.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-23
Last Modified
2026-09-23
Generated
2026-10-13
AI Q&A
2026-09-23
EPSS Evaluated
2026-10-12
NVD
CVE-2026-89331
EUVD
EUVD-2026-85053

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
fluentboards fluentboards to 2.1.0 (exc)
fluentboards fluentboards From 1.95 (inc) to 2.0.15 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-200 The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

The FluentBoards WordPress plugin before version 2.1.0 has a flaw where its public token-shared board feature does not properly restrict member data. This allows unauthenticated users to access and disclose the email addresses of board members, including administrators, without needing to log in.

Detection Guidance

Check if your FluentBoards plugin version is between 1.95 and 2.0.15. If so, test public token-shared board endpoints by accessing URLs like /wp-json/fluent-boards/v1/boards/{token}/members and inspecting the response for member email addresses.

Impact Analysis

This vulnerability could expose sensitive email addresses of board members and administrators to unauthorized individuals. Attackers might use this information for phishing, social engineering, or other malicious activities targeting those users.

Compliance Impact

This vulnerability could lead to non-compliance with GDPR and HIPAA due to unauthorized disclosure of email addresses, which may be considered personal data under these regulations. Unauthorized access to administrator emails could also violate data protection requirements for handling sensitive user information.

Mitigation Strategies

Update the FluentBoards plugin to version 2.1.0 or later immediately. If updating is not possible, consider disabling the plugin or restricting access to board endpoints until an update is applied.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-89331. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart