CVE-2026-7523 is an authorization bypass vulnerability in the Alba Board WordPress plugin (versions up to 2.1.3). The plugin fails to verify that users are authorized to perform certain actions, allowing authenticated users with minimal privileges (subscriber-level) to access private alba_card post data such as titles, descriptions, assignees, due dates, tags, and comments. The vulnerability is exacerbated by the exposure of a nonce via wp_localize_script on pages with the [alba_board] shortcode, which registers the AJAX handler via the wp_ajax_nopriv_ hook, making it accessible to unauthenticated users who can visit those pages. This combination allows unauthorized data disclosure.

An attacker with subscriber-level WordPress access can retrieve private data intended only for Administrators and Editors, including sensitive task-related information stored in alba_card posts. Because the AJAX handler and nonce are exposed on public pages, unauthenticated users may also exploit this vulnerability to access restricted data. The impact is limited to information disclosure without integrity or availability effects. The CVSS 3.1 base score is 4.3 (medium severity) reflecting low complexity and no user interaction required.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch information is provided at this time. Until a patch is available, restrict access to pages containing the [alba_board] shortcode to trusted users only or disable the Alba Board plugin if possible. Monitor vendor channels for updates and apply official patches once released.