CVE-2026-14938

MediumCVSS 4.3/10Last modified Aug 26, 2026

Description

The FluentBoards WordPress plugin before 1.95.3 does not verify that the items selected for a board import operation belong to a board the requesting user is authorized to access, allowing any authenticated user with member access to a single board to copy and read the stages and tasks (including titles, descriptions and file attachments) of any other board on the site.

Metrics

CVSS 3.1 4.3/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-639

Affected software

No affected versions have been published.

Timeline

Published
Aug 2, 2026
Last modified
Aug 26, 2026
NVD status
Deferred

Related CVEs from 2026

CVE-2026-149396.8The Visualizer WordPress plugin before 4.0.6 does not restrict a user-supplied URL to safe address ranges before fetching it server-side, aCVE-2026-149405.3A heap-buffer-overflow flaw was found in 389 Directory Server (389-ds-base). When normalizing a Distinguished Name (DN) that contains a legaCVE-2026-149415.4The Customer Reviews for WooCommerce WordPress plugin before 5.116.0 does not perform nonce or capability checks on several settings-relatedCVE-2026-149437.5The Password Protected — Lock Entire Site, Pages, Posts, Categories, and Partial Content WordPress plugin before 2.8.4 does not restrict RESCVE-2026-149467.2A high privileged remote attacker can upload a .php file and then request it directly from /uploads/<filename>.php to achieve arbitrary codeCVE-2026-149477.2A high-privileged remote attacker can upload malicious ZIP archive containing directory traversal sequences such as ../ can escape the intenCVE-2026-149488.8A low privileged remote attacker can hijack an active administrative session without needing to know the administrator password by extractinCVE-2026-149496.5A low privileged remote attacker with a valid session can submit a request to the user creation functionality exposed through /api/user/add.CVE-2026-14956.5The vulnerability, if exploited, could allow an attacker with Event Log Reader (S-1-5-32-573) privileges to obtain proxy details, including CVE-2026-149509.8An unauthenticated remote attacker in possession of a valid session identifier is able to continue using the session after it should have exCVE-2026-149518.0An low privileged remote attacker can cause authenticated users to perform unintended actions in the FDS Web interface using malicious web pCVE-2026-149527.5An unauthenticated remote attacker can retrieve sensible files from the FDS Web server, such as the backup archive at /FdsBackup.zip and add