---
id: "CVE-2026-127215"
page: "https://infrastack.ai/live/CVE-2026-127215"
kind: "vulnerability"
aliases: ["CVE-2026-127215"]
title: "WordPress Kanbanz plugin: staff users can read and edit other teams' boards"
severity: "high"
cvss: 8.6
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["kanbanz", "package", "self-hosted", "wordpress"]
not_affected_if: ["kanbanz-not-installed", "no-kanban-staff-users"]
published_at: "2026-11-13T20:18:55+00:00"
first_seen_at: "2026-11-13T21:27:23+00:00"
updated_at: "2026-11-13T21:29:32+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-127215", "first_seen_at": "2026-11-13T21:27:23+00:00"}]
exploit_sources: []
---

# WordPress Kanbanz plugin: staff users can read and edit other teams' boards

Link for people: https://infrastack.ai/live/CVE-2026-127215 (this .md is for agents)

The Kanbanz plugin for WordPress, made by Softaculous, is missing access checks on some admin-ajax handlers. A logged-in Kanban Staff user can pass another board's ID and read, change, or delete its tasks, comments, and attachments.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed Kanbanz plugin version in the WordPress admin under Plugins, or in `wp-content/plugins/kanbanz/`.
- Look for the Kanbanz plugin at all if your site uses Kanban Staff roles.

## Fix

- Kanbanz plugin: `1.0.3` or later (per the advisory summary: before 1.0.3 is affected).

## Timeline

- 2026-11-13T21:27:23+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-127215

## Documents

- [advisory] Third-party advisory: www.vulncheck.com https://www.vulncheck.com/advisories/kanbanz-wordpress-plugin-broken-access-control-via-admin-ajax-handlers

## From the sources

Kanbanz by Softaculous plugin for WordPress before 1.0.3 contains a broken access control vulnerability that allows authenticated Kanban Staff users to access and modify boards they are not members of by exploiting admin-ajax handlers that fail to call kanbanz_user_can_access_board() or per-task edit checks on attacker-supplied board_id or task_id parameters. Attackers can supply arbitrary board IDs to read sensitive task data, overwrite status columns, subtasks, and labels, inject comments, upload or delete attachments, and create tasks or set WIP limits on boards owned by other teams.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_