CVE-2026-14938— FluentBoards < 1.95.3 - Subscriber+ Cross-Board Task Disclosure via IDOR
Possible ATT&CK Techniques 1AI
T1530 · Data from Cloud StorageAffected Version Matrix 1
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| Unknown | FluentBoards | < 1.95.3 | affected |
Get alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2026-14938
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
FluentBoards < 1.95.3 - Subscriber+ Cross-Board Task Disclosure via IDOR
Source: CVE Program / CVE List V5
Vulnerability Description
The FluentBoards WordPress plugin before 1.95.3 does not verify that the items selected for a board import operation belong to a board the requesting user is authorized to access, allowing any authenticated user with member access to a single board to copy and read the stages and tasks (including titles, descriptions and file attachments) of any other board on the site.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5
Vulnerability Title
WordPress FluentBoards 授权问题漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
WordPress FluentBoards是WordPress基金会的一款项目管理软件。 WordPress FluentBoards 1.95.3之前版本存在授权问题漏洞，该漏洞源于未验证板块导入操作中所选项目是否属于请求用户有权访问的板块，可能导致拥有单个板块成员访问权限的已认证用户复制并读取网站上任何其他板块的阶段和任务（包括标题、描述和文件附件）。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Unknown | FluentBoards | 0 ~ 1.95.3 | - |
II. Public POCs for CVE-2026-14938
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCPremium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-14938
请登录查看更多情报信息。
Vendor Advisories for CVE-2026-14938 (1)
- 🔗 FluentBoards < 1.95.3 – Subscriber+ Cross-Board Task Disclosure via IDOR | CVE 2026-14938 | Plugin Vulnerabilitiesexploitvdb-entrytechnical-description
Same Patch Batch · Unknown · 2026-08-02 · 27 CVEs total
| CVE-2026-11872 | Clever Mega Menu for Visual Composer <= 1.0.1 - Subscriber+ Menu Item Meta Update via save | |
| CVE-2026-14864 | JetEngine < 3.8.12 - Contributor+ Stored XSS via jet_engine Shortcode | |
| CVE-2026-14920 | AcyMailing < 10.11.1 - Unauthenticated SQL Injection via subscription[] Parameter | |
| CVE-2026-14841 | King Addons for Elementor < 51.1.76 - Reflected XSS via Posts Grid Widget | |
| CVE-2026-15151 | Five Star Restaurant Reservations < 2.7.23 - Booking Manager+ Missing Authorization via rt | |
| CVE-2026-15206 | SMS Alert Order Notifications – WooCommerce < 3.9.8 - Unauthenticated Account Takeover via | |
| CVE-2026-16256 | Pouco Import Users <= 1.0.0 - Unauthenticated Privilege Escalation | |
| CVE-2026-15248 | Meta Box < 5.13.1 - Contributor+ Arbitrary Attachment Deletion via IDOR | |
| CVE-2026-15939 | Simple Restrict < 1.2.9 - Contributor+ Restricted Content Disclosure via REST API | |
| CVE-2026-15241 | ChatBot for eCommerce – WoowBot < 4.8.4 - Unauthenticated Gemini API Key Abuse via qcld_ge | |
| CVE-2026-15385 | RT Mega Menu < 1.5.2 - Subscriber+ Stored XSS via Menu Item CSS | |
| CVE-2026-12586 | Lenxel WP <= 1.0.31 - Unauthenticated Account Takeover via Arbitrary Password Reset | |
| CVE-2026-14817 | Element Pack Elementor Addons < 8.7.13 - Contributor+ DOM-Based Stored XSS via uikit Data | |
| CVE-2026-15236 | Gallery for Google Photos < 1.2.1 - Unauthenticated Google OAuth Token Disclosure | |
| CVE-2026-16042 | LWS Optimize < 3.4 - Subscriber+ Cache Deletion | |
| CVE-2026-16285 | WooCommerce Product Attachment < 2.3.3 - Unauthenticated Arbitrary Media Download | |
| CVE-2026-16291 | ProfileGrid < 5.9.9.8 - Subscriber+ Arbitrary Notification Deletion via IDOR | |
| CVE-2026-16261 | Huge IT Login <= 1.0.4 - Unauthenticated Account Takeover | |
| CVE-2026-16273 | Narrative Publisher <= 1.0.7 - Contributor+ Stored XSS via narrative_post_script Post Meta | |
| CVE-2026-16292 | Frontend File Manager Plugin <= 23.6 - File Metadata Update via CSRF |
Showing top 20 of 27 CVEs. View all on vendor page → →
IV. Related Vulnerabilities
Same vendor: Unknown
- CVE-2026-16055
Contest Gallery < 30.0.7 - Unauthenticated Login-Protection - CVE-2026-16036
miniOrange 2FA < 6.2.7 - 2FA Bypass via Password-Only Second - CVE-2026-17515
MLS Import < 7.0.4 - Subscriber+ Sensitive Information Discl - CVE-2026-15360
Ajax Load More < 8.0.1 - Unauthenticated SQL Injection via c - CVE-2026-15372
WP 2FA < 4.1.0 - Two-Factor Authentication Bypass via Passke
V. Comments for CVE-2026-14938
No comments yet