CVE-2026-85349 — FluentBoards < 2.0.15 - Subscriber+ Private Board Membership Disclosure via IDOR
The FluentBoards WordPress plugin before 2.0.15 does not properly verify authorization when returning the list of boards a user belongs to, allowing any authenticated user, inc…
Published: 2026-09-16 · CVSS: 4.3 · CVSS 3.1
The FluentBoards WordPress plugin before 2.0.15 does not properly verify authorization when returning the list of boards a user belongs to, allowing any authenticated user, including a Subscriber with no board access, to disclose the private board memberships of arbitrary users by referencing their user ID.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7