CVE-2026-78276 HIGH

CVE-2026-78276: WordPress Fluent Boards Pro plugin <= 2.0.11 - PHP Object Injection vulnerability

Vendor Wp Manage Ninja
Product Fluent Boards Pro
Weakness CWE-502 · Unsafe deserialization
Published August 27, 2026
Last update August 27, 2026
View on NVD All CVEs

CVSS base score

7.2/10
Attack vector Network
Attack complexity Low
Privileges required High
User interaction None
Confidentiality High
Integrity High

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

What the vulnerability does

01Description

Editor PHP Object Injection in Fluent Boards Pro <= 2.0.11 versions.

Explanation of Vulnerability in Simple Terms

02Summary

Fluent Boards Pro versions up to 2.0.11 contain a deserialization vulnerability that allows high-privileged users to execute arbitrary code on the site. An attacker with admin or equivalent access can craft malicious serialized data to trigger unintended PHP execution. This affects confidentiality, integrity, and availability of the site.

What an attacker can do

03Attacker Capabilities

Run arbitrary PHP code on the site with full admin privileges.

Potential impact on your site

04Site Impact

A compromised admin account can fully compromise your site, steal data, modify content, or install backdoors.

Conditions required to exploit

05Prerequisites

Attacker must have high-level admin or equivalent access to the WordPress installation.

Key dates

06Disclosure timeline

August 27, 2026 CVE published
August 27, 2026 Record updated

Related vulnerabilities

08Related CVE

CVE-2026-59521 WordPress Real Testimonials plugin <= 3.1.15 - PHP Object Injection vulnerability CVE-2026-66620 WordPress OptionTree plugin <= 2.7.3 - PHP Object Injection vulnerability CVE-2026-49770 WordPress WP Travel Engine plugin <= 6.7.12 - PHP Object Injection vulnerability CVE-2026-73341 WordPress RegistrationMagic plugin <= 6.0.9.7 - PHP Object Injection vulnerability CVE-2026-66650 WordPress FreightCo theme <= 1.1.15 - PHP Object Injection vulnerability