What is GHSA-7f4v-rw2p-hvrp?

GHSA-7f4v-rw2p-hvrp is a security advisory published by GitHub Security Advisories with Medium severity. The FluentBoards WordPress plugin before 2.0.15 does not properly verify authorization when...

Which CVE IDs does GHSA-7f4v-rw2p-hvrp cover?

GHSA-7f4v-rw2p-hvrp covers the following CVE IDs: CVE-2026-85349. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-7f4v-rw2p-hvrp?

GHSA-7f4v-rw2p-hvrp has a CVSS v3 base score of 4.3, published by GitHub Security Advisories.

GHSA-7f4v-rw2p-hvrpMediumCVSS 4.3

The FluentBoards WordPress plugin before 2.0.15 does not properly verify authorization when...

Vendor

GitHub Security Advisories

Published

September 16, 2026

Last Modified

September 17, 2026

🔗 CVE IDs covered (1)

CVE-2026-85349 →

📋 Description

The FluentBoards WordPress plugin before 2.0.15 does not properly verify authorization when returning the list of boards a user belongs to, allowing any authenticated user, including a Subscriber with no board access, to disclose the private board memberships of arbitrary users by referencing their user ID.

🔗 References (3)

https://nvd.nist.gov/vuln/detail/CVE-2026-85349
https://wpscan.com/vulnerability/6526a9ee-6320-472b-a179-dba009f6d76d
https://github.com/advisories/GHSA-7f4v-rw2p-hvrp