Vulnerability · Published Aug 2, 2026 · Assigned by WPScan

CVE-2026-14938FluentBoards < 1.95.3 - Subscriber+ Cross-Board Task Disclosure via IDOR

Medium 4.3

In plain English

A medium-severity authorization bypass via user-controlled key in FluentBoards from Unknown. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 19% of all known vulnerabilities).

Severity (CVSS 3.1)4.3Medium

Exploit odds (30 days)0.3%top 80.7% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

The FluentBoards WordPress plugin before 1.95.3 does not verify that the items selected for a board import operation belong to a board the requesting user is authorized to access, allowing any authenticated user with member access to a single board to copy and read the stages and tasks (including titles, descriptions and file attachments) of any other board on the site.

Affected products (as reported)

Vendor	Product	Versions
Unknown	FluentBoards	0 – before 1.95.3

Weakness: CWE-639 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

References

https://wpscan.com/vulnerability/44d91e8d-ad2f-429c-a21e-364b1fc13fdc/ exploit, vdb-entry, technical-description