CVE-2026-88910: CWE-639 Authorization Bypass Through User-Controlled Key in kboard
The kboard WordPress plugin before version 6.7 contains an authorization bypass vulnerability. This flaw allows unauthenticated attackers to delete uploaded media files and their associated database records without verifying ownership or context. The vulnerability arises from improper authorization checks when deleting board media.
AI Analysis
Technical Summary
CVE-2026-88910 is an authorization bypass vulnerability in the kboard WordPress plugin versions prior to 6.7. The plugin fails to verify whether the user requesting deletion of board media owns or is authorized to delete the media. As a result, unauthenticated attackers can iterate over media identifiers and permanently delete media files and their database records.
Potential Impact
Unauthenticated attackers can permanently delete media files uploaded to the kboard plugin and remove their corresponding database records. This can lead to data loss and disruption of content managed by the plugin. There is no indication of remote code execution or privilege escalation beyond media deletion.
Mitigation Recommendations
A fixed version 6.7 or later is implied but not explicitly confirmed. Since no official patch link or vendor advisory is provided, patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until patched, restrict access to the plugin's media deletion functionality and monitor for suspicious activity related to media deletion.
CVE-2026-88910: CWE-639 Authorization Bypass Through User-Controlled Key in kboard
Description
The kboard WordPress plugin before version 6.7 contains an authorization bypass vulnerability. This flaw allows unauthenticated attackers to delete uploaded media files and their associated database records without verifying ownership or context. The vulnerability arises from improper authorization checks when deleting board media.
Affected software
kboard
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-88910 is an authorization bypass vulnerability in the kboard WordPress plugin versions prior to 6.7. The plugin fails to verify whether the user requesting deletion of board media owns or is authorized to delete the media. As a result, unauthenticated attackers can iterate over media identifiers and permanently delete media files and their database records.
Potential Impact
Unauthenticated attackers can permanently delete media files uploaded to the kboard plugin and remove their corresponding database records. This can lead to data loss and disruption of content managed by the plugin. There is no indication of remote code execution or privilege escalation beyond media deletion.
Mitigation Recommendations
A fixed version 6.7 or later is implied but not explicitly confirmed. Since no official patch link or vendor advisory is provided, patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until patched, restrict access to the plugin's media deletion functionality and monitor for suspicious activity related to media deletion.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- WPScan
- Date Reserved
- 2026-09-10T12:28:43.299Z
- State
- PUBLISHED
Threat ID: 6aaa32e455bf5e2cf517fb4f
Added to database: 09/16/2026, 06:10:44 UTC
Last enriched: 09/16/2026, 06:17:21 UTC
Last updated: 09/16/2026, 06:27:07 UTC
Views: 4
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.