{"id":"CVE-2026-127215","kind":"vulnerability","aliases":["CVE-2026-127215"],"related":[],"title":"WordPress Kanbanz plugin: staff users can read and edit other teams' boards","description":"Kanbanz by Softaculous plugin for WordPress before 1.0.3 contains a broken access control vulnerability that allows authenticated Kanban Staff users to access and modify boards they are not members of by exploiting admin-ajax handlers that fail to call kanbanz_user_can_access_board() or per-task edit checks on attacker-supplied board_id or task_id parameters. Attackers can supply arbitrary board IDs to read sensitive task data, overwrite status columns, subtasks, and labels, inject comments, upload or delete attachments, and create tasks or set WIP limits on boards owned by other teams.","summary":"The Kanbanz plugin for WordPress, made by Softaculous, is missing access checks on some admin-ajax handlers. A logged-in Kanban Staff user can pass another board's ID and read, change, or delete its tasks, comments, and attachments.","severity":"high","cvss":8.6,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["kanbanz","package","self-hosted","wordpress"],"not_affected_if":["kanbanz-not-installed","no-kanban-staff-users"],"how_to_check":"- Check the installed Kanbanz plugin version in the WordPress admin under Plugins, or in `wp-content/plugins/kanbanz/`.\n- Look for the Kanbanz plugin at all if your site uses Kanban Staff roles.","fix":"- Kanbanz plugin: `1.0.3` or later (per the advisory summary: before 1.0.3 is affected).","status":"open","published_at":"2026-11-13T20:18:55+00:00","first_seen_at":"2026-11-13T21:27:23+00:00","triaged_at":"2026-11-13T21:29:32+00:00","updated_at":"2026-11-13T21:29:32+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-11-13T21:29:32Z","model":"claude-haiku-5-5","output":{"fix":"- Kanbanz plugin: `1.0.3` or later (per the advisory summary: before 1.0.3 is affected).","reach":"network","title":"WordPress Kanbanz plugin: staff users can read and edit other teams' boards","impact":"medium","summary":"The Kanbanz plugin for WordPress, made by Softaculous, is missing access checks on some admin-ajax handlers. A logged-in Kanban Staff user can pass another board's ID and read, change, or delete its tasks, comments, and attachments.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","kanbanz","self-hosted"],"confidence":0.7,"fix_status":"available","needs_auth":"yes","worst_case":"staff user reads and modifies other teams' boards","analyst_note":"Exploitation details and the vendor's own fix notice were not in the sources; confirm the fixed version from the NVD or plugin page.\n","how_to_check":"- Check the installed Kanbanz plugin version in the WordPress admin under Plugins, or in `wp-content/plugins/kanbanz/`.\n- Look for the Kanbanz plugin at all if your site uses Kanban Staff roles.","plain_action":"","product_name":"","needs_analyst":false,"not_affected_if":["kanbanz-not-installed","no-kanban-staff-users"],"who_is_affected":"Sites running the Kanbanz plugin before 1.0.3 that give users the Kanban Staff role. The attacker needs a staff account on the site, and the flaw lets them reach boards owned by other teams. Sites without Kanbanz or without Kanban Staff users are not exposed.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000774,"input_tokens":4685,"output_tokens":610,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-127215':15A,18A '-2026':14A,17A '1.0.3':73C 'access':35B,77C,87C,109C 'admin':40B,99C 'admin-ajax':39B,98C 'ajax':41B,100C 'allow':81C 'anoth':52B 'arbitrari':130C 'attach':65B,149C 'attack':119C,127C 'attacker-suppli':118C 'authent':82C 'board':12A,53B,90C,110C,121C,131C,158C 'broken':76C 'call':105C 'chang':58B 'check':36B,116C 'column':140C 'comment':63B,145C 'contain':74C 'control':78C 'creat':151C 'cve':13A,16A 'data':137C 'delet':60B,148C 'edit':9A,115C 'exploit':97C 'fail':103C 'handler':42B,101C 'host':23B 'id':55B,122C,125C,132C 'inject':144C 'kanban':47B,83C 'kanbanz':2A,19B,26B,66C,106C 'label':143C 'limit':156C 'log':45B 'logged-in':44B 'made':30B 'member':94C 'miss':34B 'modifi':89C 'overwrit':138C 'own':159C 'packag':20B 'paramet':126C 'pass':51B 'per':113C 'per-task':112C 'plugin':3A,27B,69C 'read':7A,57B,134C 'self':22B 'self-host':21B 'sensit':135C 'set':154C 'softacul':32B,68C 'staff':4A,48B,84C 'status':139C 'subtask':141C 'suppli':120C,129C 'task':62B,114C,124C,136C,152C 'team':11A,162C 'upload':146C 'user':5A,49B,85C,107C 'vulner':79C 'wip':155C 'wordpress':1A,24B,29B,71C","nicknames":[],"mitigations":[],"who_affected":"Sites running the Kanbanz plugin before 1.0.3 that give users the Kanban Staff role. The attacker needs a staff account on the site, and the flaw lets them reach boards owned by other teams. Sites without Kanbanz or without Kanban Staff users are not exposed.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["high","kanbanz","package","selfhosted","wordpress"],"campaign_type":null,"search_a":"'-127215':15A,18A '-2026':14A,17A 'board':12A 'cve':13A,16A 'edit':9A 'kanbanz':2A 'plugin':3A 'read':7A 'staff':4A 'team':11A 'user':5A 'wordpress':1A","search_b":"'access':35B 'admin':40B 'admin-ajax':39B 'ajax':41B 'anoth':52B 'attach':65B 'board':53B 'chang':58B 'check':36B 'comment':63B 'delet':60B 'handler':42B 'host':23B 'id':55B 'kanban':47B 'kanbanz':19B,26B 'log':45B 'logged-in':44B 'made':30B 'miss':34B 'packag':20B 'pass':51B 'plugin':27B 'read':57B 'self':22B 'self-host':21B 'softacul':32B 'staff':48B 'task':62B 'user':49B 'wordpress':24B,29B","search_c":"'1.0.3':73C 'access':77C,87C,109C 'admin':99C 'admin-ajax':98C 'ajax':100C 'allow':81C 'arbitrari':130C 'attach':149C 'attack':119C,127C 'attacker-suppli':118C 'authent':82C 'board':90C,110C,121C,131C,158C 'broken':76C 'call':105C 'check':116C 'column':140C 'comment':145C 'contain':74C 'control':78C 'creat':151C 'data':137C 'delet':148C 'edit':115C 'exploit':97C 'fail':103C 'handler':101C 'id':122C,125C,132C 'inject':144C 'kanban':83C 'kanbanz':66C,106C 'label':143C 'limit':156C 'member':94C 'modifi':89C 'overwrit':138C 'own':159C 'paramet':126C 'per':113C 'per-task':112C 'plugin':69C 'read':134C 'sensit':135C 'set':154C 'softacul':68C 'staff':84C 'status':139C 'subtask':141C 'suppli':120C,129C 'task':114C,124C,136C,152C 'team':162C 'upload':146C 'user':85C,107C 'vulner':79C 'wip':155C 'wordpress':71C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-13T20:18:55+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-127215","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-127215","severity":null,"published_at":"2026-11-13T20:18:55+00:00","modified_at":"2026-11-13T20:18:55+00:00","first_seen_at":"2026-11-13T21:27:23+00:00","fetched_at":"2026-11-13T21:27:23+00:00","note":null}],"documents":[{"id":149710,"url":"https://www.vulncheck.com/advisories/kanbanz-wordpress-plugin-broken-access-control-via-admin-ajax-handlers","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}