CVE-2026-14938 Overview
CVE-2026-14938 is an Insecure Direct Object Reference [CWE-639] vulnerability in the FluentBoards WordPress plugin before version 1.95.3. The plugin's board import operation does not verify that items selected for import belong to a board the requesting user is authorized to access. Any authenticated user with member access to a single board can copy and read stages and tasks belonging to any other board on the site. Exposed content includes titles, descriptions, and file attachments. The issue affects confidentiality of project data managed within FluentBoards.
Critical Impact
Authenticated low-privilege users can read stages, tasks, descriptions, and file attachments from boards they do not own.
Affected Products
- FluentBoards WordPress plugin versions prior to 1.95.3
Discovery Timeline
- 2026-08-02 - CVE-2026-14938 published to NVD
- 2026-08-05 - Last updated in NVD database
Technical Details for CVE-2026-14938
Vulnerability Analysis
FluentBoards implements a board import feature that copies stages, tasks, and attachments from a source board into a target board. The vulnerable endpoint accepts identifiers for the items to import but does not enforce that the requesting user has permission to read those items. An attacker who is a member of any single board can supply identifiers pointing to items on unrelated boards and receive their contents through the import result.
The vulnerability discloses stage names, task titles, task descriptions, and any file attachments referenced by those tasks. It does not modify or destroy data on the source board, and it does not grant elevated privileges beyond read access to the copied content. Exploitation only requires an authenticated session with membership on at least one board.
Root Cause
The root cause is missing authorization on referenced objects. The import handler validates that the caller can write to the target board but does not validate that the caller can read the source items identified in the request. This is a classic authorization check on the operation but not on the object [CWE-639].
Attack Vector
An authenticated attacker crafts an import request against a board they legitimately control and supplies stage or task identifiers belonging to another board on the same site. The server processes the request, copies the referenced records into the attacker's board, and returns the copied data including titles, descriptions, and attachments. See the WPScan Vulnerability Report for additional technical detail.
Detection Methods for CVE-2026-14938
Indicators of Compromise
- Unexpected task or stage records appearing on a user's board that mirror content from other boards on the site.
- Import operations initiated by low-privilege members that reference identifiers outside their board membership.
- Attachment access log entries where the requesting user has no direct membership on the source board.
Detection Strategies
- Review FluentBoards import API calls in web server access logs for requests referencing item identifiers from boards the caller does not belong to.
- Correlate wp_users board membership with imported item ownership to identify cross-board copies.
- Enable WordPress audit logging to capture plugin actions performed by non-administrative accounts.
Monitoring Recommendations
- Monitor for spikes in board import operations following user account creation or membership changes.
- Alert on any import request whose source object owner differs from the requester's board memberships.
- Track anomalous downloads of attachments from FluentBoards uploads directories by newly active users.
How to Mitigate CVE-2026-14938
Immediate Actions Required
- Update the FluentBoards plugin to version 1.95.3 or later on all WordPress sites.
- Audit existing board contents for tasks or stages that appear to have been imported from other boards without authorization.
- Review the FluentBoards user roster and remove accounts that do not require access.
Patch Information
The vendor addressed the vulnerability in FluentBoards 1.95.3 by adding authorization checks that verify the requesting user has access to each source item referenced in an import operation. Refer to the WPScan Vulnerability Report for advisory details.
Workarounds
- Restrict FluentBoards membership so that untrusted users cannot authenticate against the plugin until the patch is applied.
- Temporarily disable the FluentBoards plugin on sites that cannot upgrade immediately if sensitive project data is stored in boards.
- Segment sensitive boards onto a separate WordPress instance with a distinct user base until remediation is complete.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
