CVE-2026-40784 HIGH

CVE-2026-40784: WordPress FluentBoards plugin <= 1.91.2 - Insecure Direct Object References (IDOR) vulnerability

Vendor Mahmudul Hasan Arif
Product FluentBoards
Weakness CWE-639 · IDOR
Published April 15, 2026
Last update April 29, 2026
View on NVD All CVEs

CVSS base score

8.1/10
Attack vector Network
Attack complexity Low
Privileges required Low
User interaction None
Confidentiality High
Integrity High

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

What the vulnerability does

01Description

Authorization Bypass Through User-Controlled Key vulnerability in Mahmudul Hasan Arif FluentBoards fluent-boards allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects FluentBoards: from n/a through <= 1.91.2.

Explanation of Vulnerability in Simple Terms

02Summary

FluentBoards versions up to 1.91.2 contain an authorization flaw that allows authenticated users to read and modify sensitive data they should not access. An attacker with a low-privilege account can view or alter confidential information without additional user interaction. The vulnerability affects all versions from 0 through 1.91.2.

What an attacker can do

03Attacker Capabilities

Read and modify sensitive data belonging to other users or the site.

Potential impact on your site

04Site Impact

Any registered user can access and alter confidential information across the site.

Conditions required to exploit

05Prerequisites

Attacker must have a low-privilege account on the site; no user interaction required.

Key dates

06Disclosure timeline

April 15, 2026 CVE published
April 29, 2026 Record updated

Related vulnerabilities

08Related CVE

CVE-2026-57341 WordPress Colissimo Officiel : Méthodes de livraison pour WooCommerce plugin <= 2.9.0 - Insecure Direct Object References (IDOR) vulnerability CVE-2026-10780 Static Block <= 2.2 - Insecure Direct Object Reference to Authenticated (Contributor+) Sensitive Information Disclosure via Shortcode 'id' Attribute CVE-2026-6206 MW WP Form <= 5.1.2 - Insecure Direct Object Reference to Unauthenticated Sensitive Information Disclosure via 'post_id' Query Parameter CVE-2026-7638 App Builder <= 5.5.10 - Insecure Direct Object Reference to Authenticated (Subscriber+) Arbitrary User Avatar Modification via 'user_id' Parameter CVE-2026-12904 Kadence Blocks <= 3.7.7 - Insecure Direct Object Reference to Authenticated (Contributor+) Arbitrary Optimizer Data Deletion/Read/Modification via 'post_path' Parameter