# CVE-2026-78276: Fluent Boards Pro PHP object injection

Source: https://junglewise.ai/threats/cve-2026-78276-fluent-boards-pro-php-object-injection  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-27. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-78276 · Severity: high · CVSS 7.2 · Published 2026-08-27

Fluent Boards Pro is a WordPress plugin for collaborative project management and task tracking. An unauthenticated attacker can inject malicious PHP objects through the editor interface, allowing arbitrary code execution on the affected website. This poses a critical risk to website availability, customer data, and can lead to complete server compromise.

## Quick answers

**Is CVE-2026-78276 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-78276 being exploited in the wild.

**How severe is CVE-2026-78276?** High severity, with a CVSS score of 7.2, published 27 August 2026.

**Which products and versions are affected?** ManageNinja LLC Fluent Boards Pro <= 2.0.11.

**Is there a fix for CVE-2026-78276?** A patch was published on 2026-08-26: Fixed in version 2.0.12 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-78276 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-78276?** Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is a PHP object injection flaw in Fluent Boards Pro versions up to 2.0.11, classified as an OWASP A3 Injection issue. The vulnerability requires the Editor privilege level to exploit, allowing attackers to manipulate how the site processes serialized data to execute arbitrary actions on the server. An attacker with editor privileges (or those who can bypass authentication to reach the editor) can instantiate malicious PHP objects and trigger remote code execution. The vulnerability has been patched in version 2.0.12 and later. Patchstack has released a mitigation rule to block attack attempts until sites are updated.

## Affected products

- ManageNinja LLC Fluent Boards Pro <= 2.0.11

## Timeline

- 2026-08-26: disclosed
- 2026-08-26: patched: Fixed in version 2.0.12

## References

- [https://patchstack.com/database/wordpress/plugin/fluent-boards-pro/vulnerability/wordpress-fluent-boards-pro-plugin-2-0-11-php-object-injection-vulnerability?_s_id=cve](https://patchstack.com/database/wordpress/plugin/fluent-boards-pro/vulnerability/wordpress-fluent-boards-pro-plugin-2-0-11-php-object-injection-vulnerability?_s_id=cve)