What is GHSA-6w2r-gp8j-3hjr?

GHSA-6w2r-gp8j-3hjr is a security advisory published by GitHub Security Advisories with Medium severity. The kboard WordPress plugin before 6.7 does not verify ownership or context before deleting board...

Which CVE IDs does GHSA-6w2r-gp8j-3hjr cover?

GHSA-6w2r-gp8j-3hjr covers the following CVE IDs: CVE-2026-88910. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-6w2r-gp8j-3hjr?

GHSA-6w2r-gp8j-3hjr has a CVSS v3 base score of 5.3, published by GitHub Security Advisories.

GHSA-6w2r-gp8j-3hjrMediumCVSS 5.3

The kboard WordPress plugin before 6.7 does not verify ownership or context before deleting board...

Vendor

GitHub Security Advisories

Published

September 16, 2026

Last Modified

September 17, 2026

🔗 CVE IDs covered (1)

CVE-2026-88910 →

📋 Description

The kboard WordPress plugin before 6.7 does not verify ownership or context before deleting board media, allowing unauthenticated attackers to permanently delete its uploaded media files and their database records by iterating identifiers.

🔗 References (3)

https://nvd.nist.gov/vuln/detail/CVE-2026-88910
https://wpscan.com/vulnerability/96119ba5-4dcd-4aff-adf9-83f058c3dc6d
https://github.com/advisories/GHSA-6w2r-gp8j-3hjr