Quick answers
- Is CVE-2026-78274 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-78274 being exploited in the wild.
- How severe is CVE-2026-78274?
- Critical severity, with a CVSS score of 9.1, published 27 August 2026.
- Which products and versions are affected?
- ManageNinja Fluent Boards Pro ≤ 2.0.11.
- Is there a fix for CVE-2026-78274?
- A patch was published on 2026-08-27: Version 2.0.12 released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-78274 attacked?
- It is attacked over the network.
- Am I affected by CVE-2026-78274?
- Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
The vulnerability is an arbitrary file upload weakness in the Fluent Boards Pro WordPress plugin that allows users with Editor privileges to bypass file upload restrictions and upload malicious files to the server. The root cause lies in insufficient validation or sanitization of uploaded files in the editor functionality. Exploitation requires Editor-level authentication but no additional user interaction. A successful exploit allows an attacker to upload webshells or other malicious code, leading to remote code execution and complete server compromise. The vulnerability is patched in version 2.0.12 and later; affected versions are 2.0.11 and below.
Affected products
- ManageNinja Fluent Boards Pro ≤ 2.0.11
Timeline
- 2026-08-26: disclosed
- 2026-08-27: advisory
- 2026-08-27: patched: Version 2.0.12 released