Junglewise Threat Intelligence

CVE-2026-7523: Alba Board WordPress plugin authorization bypass in AJAX handler

CVE-2026-7523 · Severity: medium · CVSS 4.3 · Published 2026-06-05

Executive brief

The Alba Board plugin for WordPress, which provides project management and task tracking features, contains a security flaw that allows unauthorized users to view private task data. This includes sensitive information such as task descriptions, assignees, due dates, and internal comments that should only be visible to administrators. An attacker could use this information to gain insight into internal business operations or project timelines.

Technical details

The Alba Board plugin for WordPress suffers from a missing authorization check (CWE-862) in its AJAX handler for retrieving card details. The vulnerability exists because the plugin fails to verify user permissions before returning 'alba_card' post data. While the CVSS score reflects authenticated subscriber-level access, the handler is registered via the 'wp_ajax_nopriv_' hook and its security nonce is exposed via 'wp_localize_script' on pages using the [alba_board] shortcode. This allows any user who can access a page with that shortcode to retrieve arbitrary private post data including titles, descriptions, assignees, and comments. The issue is addressed in versions following 2.1.3.

Affected products

  • Alba Board Alba Board up to, and including, 2.1.3

Timeline

  • 2026-06-05: disclosed
  • 2026-06-05: advisory

References