CVE-2026-127215 · Package
NO FIX YET · SEE WHAT TO DO
The Kanbanz plugin for WordPress, made by Softaculous, is missing access checks on some admin-ajax handlers. A logged-in Kanban Staff user can pass another board's ID and read, change, or delete its tasks, comments, and attachments.
first public Nov 13, 2026 · 1 source
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
Sites running the Kanbanz plugin before 1.0.3 that give users the Kanban Staff role. The attacker needs a staff account on the site, and the flaw lets them reach boards owned by other teams. Sites without Kanbanz or without Kanban Staff users are not exposed.
Not affected if kanbanz-not-installed, no-kanban-staff-users
Who cares kanbanz, self-hosted, wordpress
wp-content/plugins/kanbanz/.1.0.3 or later (per the advisory summary: before 1.0.3 is affected).Kanbanz by Softaculous plugin for WordPress before 1.0.3 contains a broken access control vulnerability that allows authenticated Kanban Staff users to access and modify boards they are not members of by exploiting admin-ajax handlers that fail to call kanbanz_user_can_access_board() or per-task edit checks on attacker-supplied board_id or task_id parameters. Attackers can supply arbitrary board IDs to read sensitive task data, overwrite status columns, subtasks, and labels, inject comments, upload or delete attachments, and create tasks or set WIP limits on boards owned by other teams.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.