---
id: "CVE-2026-115958"
kind: "vulnerability"
aliases: ["CVE-2026-115958"]
title: "WP Discussion Board: missing authorization check exposes protected actions"
severity: "medium"
cvss: 5.3
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["package", "wordpress", "wp-discussion-board"]
not_affected_if: ["plugin-not-installed"]
published_at: "2026-10-26T10:16:52+00:00"
first_seen_at: "2026-10-26T10:29:17+00:00"
updated_at: "2026-10-26T10:30:55+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-115958", "first_seen_at": "2026-10-26T10:29:17+00:00"}]
---

# WP Discussion Board: missing authorization check exposes protected actions

WP Discussion Board, a WordPress plugin, has a missing authorization check that lets requests reach functions without the proper access control. Sources do not say which actions an attacker can perform or what data they can read or change.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed plugin version of `wp-discussion-board` in the WordPress admin plugin list or with `wp plugin get wp-discussion-board --field=version`
- unknown for anything else

## Fix

- Update `wp-discussion-board` to a version later than `2.6.0`, if a fixed release is published
- unknown for any other step

## Timeline

- 2026-10-26T10:29:17+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-115958

## From the sources

Missing Authorization vulnerability in WP Discussion Board WP Discussion Board wp-discussion-board allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Discussion Board: from n/a through 2.6.0.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_