CVE-2026-78274: CWE-434 Unrestricted Upload of File with Dangerous Type in WP Manage Ninja Fluent Boards Pro

This vulnerability (CVE-2026-78274) in Fluent Boards Pro (<= 2.0.11) allows users with editor-level permissions to upload arbitrary files without proper restrictions, classified under CWE-434 (Unrestricted Upload of File with Dangerous Type). The flaw can be exploited remotely over the network with low attack complexity and no user interaction, affecting confidentiality, integrity, and availability with a CVSS 3.1 score of 9.1. The vulnerability is currently published but lacks an official remediation or patch from the vendor. It is not a cloud service, so remediation depends on the plugin vendor and user updates.

Successful exploitation could allow an attacker with editor privileges to upload malicious files, potentially leading to full system compromise including data theft, code execution, and service disruption. The vulnerability affects confidentiality, integrity, and availability at a critical level. No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict editor permissions to trusted users only and monitor for suspicious file uploads. Avoid using vulnerable versions of Fluent Boards Pro if possible.