CVE-2026-89331: FluentBoards WordPress Information Disclosure

CVE-2026-89331 Overview

CVE-2026-89331 is an information disclosure vulnerability in the FluentBoards WordPress plugin versions prior to 2.1.0. The plugin's public, token-shared board feature does not properly restrict member data returned to unauthenticated visitors. Attackers accessing a shared board link can enumerate the email addresses of board members, which frequently include site administrators. The flaw is classified under [CWE-200] (Exposure of Sensitive Information to an Unauthorized Actor).

Critical Impact
Unauthenticated remote actors can harvest administrator and member email addresses from any FluentBoards site that uses public token-shared boards, enabling targeted phishing and credential-stuffing campaigns.

Affected Products

FluentBoards WordPress plugin versions before 2.1.0
WordPress installations exposing shared FluentBoards boards via public tokens
Site administrators and board members whose emails are stored in FluentBoards

Discovery Timeline

2026-09-23 - CVE-2026-89331 published to NVD
2026-09-23 - Last updated in NVD database

Technical Details for CVE-2026-89331

Vulnerability Analysis

FluentBoards implements a board-sharing feature that generates a token allowing unauthenticated visitors to view a board without logging in. When a visitor retrieves board data through this public endpoint, the server returns the full member object for each participant. That object includes email addresses that should be limited to authenticated collaborators.

The vulnerability is a broken access control issue combined with over-fetching of user data. The token grants view access to the board, but the response schema is not reduced for anonymous callers. Any actor who obtains or guesses a valid share token gains the same visibility as an authenticated member for the purpose of member enumeration.

Because boards frequently include the WordPress administrator among members, this exposure typically discloses privileged account emails. Attackers can use these addresses to craft targeted phishing, password reset abuse, and credential-stuffing attacks against the site.

Root Cause

The plugin fails to differentiate between authenticated and token-based board access when serializing member data. The API returns email fields regardless of caller identity, violating the principle of least privilege documented in [CWE-200].

Attack Vector

An unauthenticated remote attacker sends an HTTP request to the public shared-board endpoint using a valid share token. The response contains member records with email addresses. No user interaction and no privileges are required. See the WPScan Vulnerability Report for further technical detail.

No verified proof-of-concept code is published. The vulnerability is exploited entirely through normal HTTP requests to the plugin's public board API.

Detection Methods for CVE-2026-89331

Indicators of Compromise

Unauthenticated HTTP requests to FluentBoards REST endpoints that include a share_token or equivalent query parameter
Repeated requests from a single IP enumerating multiple board share tokens
Outbound responses from the site containing JSON payloads with email fields for board members served to anonymous sessions

Detection Strategies

Inspect web server and WordPress access logs for requests to FluentBoards public board routes and correlate with responses returning member data
Deploy a Web Application Firewall (WAF) rule that flags anonymous responses containing email keys from FluentBoards endpoints
Baseline normal share-token access patterns and alert on volume or geographic anomalies

Monitoring Recommendations

Forward WordPress and reverse-proxy logs to a centralized SIEM for correlation with authentication events
Monitor administrator mailboxes for a rise in targeted phishing attempts following any suspected exposure
Track plugin version inventory across WordPress fleets to identify unpatched FluentBoards installations

How to Mitigate CVE-2026-89331

Immediate Actions Required

Upgrade the FluentBoards plugin to version 2.1.0 or later on all WordPress sites
Audit existing public share tokens and revoke any that are no longer required
Notify administrators and board members whose emails may have been exposed so they can watch for phishing

Patch Information

The vendor addressed the issue in FluentBoards 2.1.0 by restricting the member data returned through the public token-shared board feature. Refer to the WPScan Vulnerability Report for advisory details.

Workarounds

Disable the public share feature for all FluentBoards boards until the plugin is updated
Restrict access to the WordPress /wp-json/ FluentBoards routes at the WAF or reverse proxy for unauthenticated clients
Rotate share tokens after upgrading to invalidate any tokens previously distributed or leaked

bash

# Example: block unauthenticated access to FluentBoards REST routes at nginx
location ~* /wp-json/fluent-boards/ {
    if ($http_authorization = "") {
        return 403;
    }
}