{"id":"CVE-2026-119486","kind":"vulnerability","aliases":["CVE-2026-119486"],"related":[],"title":"FluentBoards WordPress plugin: missing authorization check on access control","description":"Missing Authorization vulnerability in WP ManageNinja LLC FluentBoards fluent-boards allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects FluentBoards: from n/a through 2.2.2.","summary":"FluentBoards, a WordPress project management plugin, has a missing authorization check that allows access control to be bypassed. The sources say an attacker may gain actions their role should not allow, but do not describe the exact action.","severity":"medium","cvss":4.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["fluent-boards","other","wordpress"],"not_affected_if":["plugin-not-installed"],"how_to_check":"- Check the installed FluentBoards version in the WordPress plugins screen or `wp plugin get fluent-boards --field=version`\n- Compare the version against the affected range: from n/a through `2.2.2`","fix":"- Move FluentBoards past `2.2.2` (fixed version not stated in the sources)","status":"open","published_at":"2026-11-07T10:17:08+00:00","first_seen_at":"2026-11-07T10:46:40+00:00","triaged_at":"2026-11-07T10:48:56+00:00","updated_at":"2026-11-07T10:48:56+00:00","category":"other","confidence":0.5,"triage":{"at":"2026-11-07T10:48:56Z","model":"claude-haiku-5-5","output":{"fix":"- Move FluentBoards past `2.2.2` (fixed version not stated in the sources)","reach":"internet","title":"FluentBoards WordPress plugin: missing authorization check on access control","impact":"medium","summary":"FluentBoards, a WordPress project management plugin, has a missing authorization check that allows access control to be bypassed. The sources say an attacker may gain actions their role should not allow, but do not describe the exact action.","audience":"businesses","category":"other","nicknames":[],"who_cares":["wordpress","fluent-boards"],"confidence":0.5,"fix_status":"unknown","needs_auth":"unknown","worst_case":"unknown access beyond intended role permissions on the site","analyst_note":"Find the fixed version and the exact unauthorized action in the NVD entry or the vendor/WPScan advisory for CVE-2026-119486.","how_to_check":"- Check the installed FluentBoards version in the WordPress plugins screen or `wp plugin get fluent-boards --field=version`\n- Compare the version against the affected range: from n/a through `2.2.2`","plain_action":"","needs_analyst":true,"not_affected_if":["plugin-not-installed"],"who_is_affected":"Sites running the FluentBoards plugin version 2.2.2 or earlier are in the affected range. The sources do not say which roles or settings are needed to exploit it, so unknown whether a logged-in user is required.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000688,"input_tokens":4224,"output_tokens":531,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-119486':12A,15A '-2026':11A,14A '2.2.2':84C 'access':8A,34B,74C 'action':46B,58B 'affect':79C 'allow':33B,51B,70C 'attack':43B 'author':5A,30B,60C 'board':18B,69C 'bypass':38B 'check':6A,31B 'configur':73C 'control':9A,35B,75C 'cve':10A,13A 'describ':55B 'exact':57B 'exploit':71C 'fluent':17B,68C 'fluent-board':16B,67C 'fluentboard':1A,21B,66C,80C 'gain':45B 'incorrect':72C 'issu':78C 'levels.this':77C 'llc':65C 'manag':25B 'manageninja':64C 'may':44B 'miss':4A,29B,59C 'n/a':82C 'plugin':3A,26B 'project':24B 'role':48B 'say':41B 'secur':76C 'sourc':40B 'vulner':61C 'wordpress':2A,20B,23B 'wp':63C","nicknames":[],"mitigations":[],"who_affected":"Sites running the FluentBoards plugin version 2.2.2 or earlier are in the affected range. The sources do not say which roles or settings are needed to exploit it, so unknown whether a logged-in user is required.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["fluentboards","medium","other","wordpress"],"campaign_type":null,"search_a":"'-119486':12A,15A '-2026':11A,14A 'access':8A 'author':5A 'check':6A 'control':9A 'cve':10A,13A 'fluentboard':1A 'miss':4A 'plugin':3A 'wordpress':2A","search_b":"'access':34B 'action':46B,58B 'allow':33B,51B 'attack':43B 'author':30B 'board':18B 'bypass':38B 'check':31B 'control':35B 'describ':55B 'exact':57B 'fluent':17B 'fluent-board':16B 'fluentboard':21B 'gain':45B 'manag':25B 'may':44B 'miss':29B 'plugin':26B 'project':24B 'role':48B 'say':41B 'sourc':40B 'wordpress':20B,23B","search_c":"'2.2.2':84C 'access':74C 'affect':79C 'allow':70C 'author':60C 'board':69C 'configur':73C 'control':75C 'exploit':71C 'fluent':68C 'fluent-board':67C 'fluentboard':66C,80C 'incorrect':72C 'issu':78C 'levels.this':77C 'llc':65C 'manageninja':64C 'miss':59C 'n/a':82C 'secur':76C 'vulner':61C 'wp':63C","first_public_at":"2026-11-07T10:17:08+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","cvss_by":"audit@patchstack.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-119486","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-119486","severity":null,"published_at":"2026-11-07T10:17:08+00:00","modified_at":"2026-11-07T10:17:08+00:00","first_seen_at":"2026-11-07T10:46:40+00:00","fetched_at":"2026-11-07T10:46:40+00:00","note":null}],"documents":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}