Executive brief
FluentBoards is a WordPress plugin for creating and sharing collaborative boards. The plugin improperly restricts access to member information in publicly shared boards, allowing anyone with the board's sharing link to view the email addresses of all board members, including administrators. This enables targeted phishing, account takeover, and other social engineering attacks against board participants.
Technical details
The plugin's public, token-shared board feature fails to restrict member data in API responses, exposing email addresses to unauthenticated users who possess the shared board token. This is an information disclosure vulnerability (CWE-200) reachable via network access without authentication. An attacker with the board link gains the ability to enumerate and collect administrator email addresses for further attacks.
Affected products
- WordPress FluentBoards 1.95 to 2.0.15
Timeline
- 2026-09-21: disclosed
- 2026-09-23: patched: Fixed in version 2.1.0