CVE-2026-85349: CWE-200 Information Exposure in FluentBoards
The FluentBoards WordPress plugin before 2.0.15 does not properly verify authorization when returning the list of boards a user belongs to, allowing any authenticated user, including a Subscriber with no board access, to disclose the private board memberships of arbitrary users by referencing their user ID.
AI Analysis
Technical Summary
The FluentBoards WordPress plugin prior to version 2.0.15 contains an authorization bypass vulnerability that leads to information exposure (CWE-200). Specifically, the plugin does not correctly verify whether the requesting user is authorized to view the list of boards associated with another user. As a result, any authenticated user can retrieve private board membership details of arbitrary users by supplying their user ID.
Potential Impact
An attacker with any authenticated user account, including low-privilege Subscriber roles, can access private information about other users' board memberships. This exposure of private membership data could lead to privacy violations or facilitate further targeted attacks based on knowledge of user affiliations within the system.
Mitigation Recommendations
Upgrade FluentBoards to version 2.0.15 or later, where this authorization verification issue has been fixed. Since no official patch link is provided, users should consult the FluentBoards plugin repository or vendor for the official update. Until patched, restrict plugin usage to trusted users and monitor for unauthorized access attempts.
CVE-2026-85349: CWE-200 Information Exposure in FluentBoards
Description
The FluentBoards WordPress plugin before 2.0.15 does not properly verify authorization when returning the list of boards a user belongs to, allowing any authenticated user, including a Subscriber with no board access, to disclose the private board memberships of arbitrary users by referencing their user ID.
Affected software
FluentBoards
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The FluentBoards WordPress plugin prior to version 2.0.15 contains an authorization bypass vulnerability that leads to information exposure (CWE-200). Specifically, the plugin does not correctly verify whether the requesting user is authorized to view the list of boards associated with another user. As a result, any authenticated user can retrieve private board membership details of arbitrary users by supplying their user ID.
Potential Impact
An attacker with any authenticated user account, including low-privilege Subscriber roles, can access private information about other users' board memberships. This exposure of private membership data could lead to privacy violations or facilitate further targeted attacks based on knowledge of user affiliations within the system.
Mitigation Recommendations
Upgrade FluentBoards to version 2.0.15 or later, where this authorization verification issue has been fixed. Since no official patch link is provided, users should consult the FluentBoards plugin repository or vendor for the official update. Until patched, restrict plugin usage to trusted users and monitor for unauthorized access attempts.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- WPScan
- Date Reserved
- 2026-09-03T17:17:56.927Z
- State
- PUBLISHED
Threat ID: 6aaa32e255bf5e2cf517fb36
Added to database: 09/16/2026, 06:10:42 UTC
Last enriched: 09/16/2026, 06:19:21 UTC
Last updated: 09/16/2026, 22:11:12 UTC
Views: 12
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.