CVE-2026-89331
Received Received - Intake

Unauthenticated Email Disclosure in FluentBoards WordPress Plugin

Publication date: 2026-09-23

Last updated on: 2026-09-23

Assigner: WPScan

Description
The FluentBoards WordPress plugin before 2.1.0 does not properly restrict the member data returned by its public, token-shared board feature, allowing unauthenticated users to disclose the email addresses of a shared board's members, typically including administrators.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-23
Last Modified
2026-09-23
Generated
2026-09-23
AI Q&A
2026-09-23
EPSS Evaluated
N/A
NVD
CVE-2026-89331
EUVD
EUVD-2026-85053

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
fluentboards fluentboards to 2.1.0 (exc)
fluentboards fluentboards From 1.95 (inc) to 2.0.15 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

The FluentBoards WordPress plugin before version 2.1.0 has a flaw where its public token-shared board feature does not properly restrict member data. This allows unauthenticated users to access and disclose the email addresses of board members, including administrators, without needing to log in.

Detection Guidance

Check if your FluentBoards plugin version is between 1.95 and 2.0.15. If so, test public token-shared board endpoints by accessing URLs like /wp-json/fluent-boards/v1/boards/{token}/members and inspecting the response for member email addresses.

Impact Analysis

This vulnerability could expose sensitive email addresses of board members and administrators to unauthorized individuals. Attackers might use this information for phishing, social engineering, or other malicious activities targeting those users.

Mitigation Strategies

Update the FluentBoards plugin to version 2.1.0 or later immediately. If updating is not possible, consider disabling the plugin or restricting access to board endpoints until an update is applied.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-89331. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart