CVE-2026-85349 Overview
CVE-2026-85349 is a broken access control vulnerability in the FluentBoards WordPress plugin versions prior to 2.0.15. The plugin fails to verify authorization when returning the list of boards a user belongs to. Any authenticated user, including a Subscriber with no board access, can disclose the private board memberships of arbitrary users by referencing their user ID. The flaw is categorized under [CWE-200] (Exposure of Sensitive Information to an Unauthorized Actor).
Critical Impact
Authenticated low-privilege users can enumerate private board memberships of any WordPress user, exposing internal project structure and collaboration relationships.
Affected Products
- FluentBoards WordPress plugin versions before 2.0.15
- WordPress sites with FluentBoards installed and open user registration
- Multi-user WordPress environments using FluentBoards for private project management
Discovery Timeline
- 2026-09-16 - CVE-2026-85349 published to NVD
- 2026-09-17 - Last updated in NVD database
Technical Details for CVE-2026-85349
Vulnerability Analysis
The vulnerability resides in a FluentBoards endpoint that returns the list of boards associated with a given user ID. The endpoint authenticates the requester but does not check whether the requester is authorized to view boards belonging to the target user. As a result, the API returns board membership data for any user ID supplied in the request. This constitutes an Insecure Direct Object Reference (IDOR) pattern where the target user identifier is trusted without further authorization checks. The information disclosed includes membership associations that were intended to remain private to board participants and administrators.
Root Cause
The root cause is a missing authorization check in the request handler that services board-membership lookups. The handler verifies that the caller is logged in but omits a comparison between the caller's identity or capability set and the target user ID. Subscriber-level accounts, which normally have no plugin-specific privileges, therefore inherit read access to data that should be restricted to the target user or administrators.
Attack Vector
An attacker registers or uses any low-privilege WordPress account, including a Subscriber. The attacker then issues authenticated requests to the vulnerable FluentBoards endpoint while incrementing the target user ID parameter. Each response reveals the boards to which the referenced user belongs. Enumeration across the WordPress user base yields a map of private board memberships and collaboration relationships across the site.
No public proof-of-concept code is available. Technical details are documented in the WPScan Vulnerability Report.
Detection Methods for CVE-2026-85349
Indicators of Compromise
- Repeated authenticated requests from a single low-privilege account to FluentBoards REST endpoints referencing multiple sequential user IDs.
- Unusual volume of 200 OK responses to board-listing API calls originating from Subscriber-level sessions.
- Access log entries showing enumeration patterns against FluentBoards endpoints outside normal application workflows.
Detection Strategies
- Review WordPress access logs for FluentBoards API paths correlated with Subscriber or newly registered accounts.
- Alert on high-frequency access to board-membership endpoints where the requesting user does not own the referenced boards.
- Baseline normal FluentBoards API usage per role and flag deviations, particularly reads by roles without board assignments.
Monitoring Recommendations
- Enable WordPress audit logging with plugin coverage to capture REST API calls and their parameters.
- Forward web server and WordPress logs to a central analytics platform for correlation and long-term retention.
- Monitor account creation activity if open registration is enabled, and correlate new accounts with subsequent API enumeration.
How to Mitigate CVE-2026-85349
Immediate Actions Required
- Upgrade the FluentBoards plugin to version 2.0.15 or later on all WordPress instances.
- Audit existing WordPress user accounts and disable or remove Subscriber accounts that are not required.
- Review board membership data for signs of prior unauthorized enumeration.
Patch Information
The vendor has resolved the issue in FluentBoards version 2.0.15. The fix introduces proper authorization validation on the board-membership endpoint so that only the target user or authorized administrators can retrieve the list. Refer to the WPScan Vulnerability Report for the disclosed fix reference.
Workarounds
- Disable open user registration in WordPress settings until the patch is applied.
- Temporarily deactivate the FluentBoards plugin on sites that cannot upgrade immediately.
- Restrict access to the WordPress REST API from untrusted networks using a web application firewall.
# Disable open registration via wp-cli until patched
wp option update users_can_register 0
# Confirm installed FluentBoards version
wp plugin get fluent-boards --field=version
# Upgrade FluentBoards to a fixed release
wp plugin update fluent-boards --version=2.0.15
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
