CVE-2026-40784 - WordPress FluentBoards plugin <= 1.91.2 - Insecure Direct Object References (IDOR) vulnerability

Back Back to CVE browser

HIGH

WordPress FluentBoards plugin <= 1.91.2 - Insecure Direct Object References (IDOR) vulnerability

Published Apr 15, 2026

8.1

HIGH

CVSS 3.1

EPSS 0.27%

Description

Authorization Bypass Through User-Controlled Key vulnerability in Mahmudul Hasan Arif FluentBoards fluent-boards allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects FluentBoards: from n/a through <= 1.91.2.

Affected products

Vendor Mahmudul Hasan Arif Product FluentBoards Default
unaffected
- Version
  0
  Status
  affected
  Constraints
  <=1.91.2

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Mahmudul Hasan Arif

FluentBoards

unaffected

Version	Status	Constraints
0	affected	<=1.91.2

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-639

Authorization Bypass

References (2)

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-22907		Advisory
https://patchstack.com/database/Wordpress/Plugin/fluent-boards/vulnerability/wordpress-fluentboards-plugin-1-91-2-insecure-direct-object-references-idor-vulnerability?_s_id=cve		vdb-entry