# CVE-2026-96821: FluentBoards privilege escalation

Source: https://junglewise.ai/threats/cve-2026-96821-subscriber-privilege-escalation-in-fluentboards-2-0-12-versions  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-30. Updated: 2026-09-30  
License: CC BY 4.0 with a link back

CVE-2026-96821 · Severity: medium · CVSS 6.3 · Published 2026-09-30

FluentBoards is a WordPress plugin for collaborative project management and team communication. A privilege escalation vulnerability allows subscribers to gain elevated permissions within the plugin, potentially accessing restricted content or admin features not intended for their role. This affects versions up to 2.0.12.

Technologies: [FluentBoards](https://junglewise.ai/threats/technologies/fluentboards). Vendors: [FluentBoards](https://junglewise.ai/threats/vendors/fluentboards).

## Quick answers

**Is CVE-2026-96821 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-96821 being exploited in the wild.

**How severe is CVE-2026-96821?** Medium severity, with a CVSS score of 6.3, published 30 September 2026.

**Which products and versions are affected?** FluentBoards up to 2.0.12.

**Is there a fix for CVE-2026-96821?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-96821 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-96821?** Check whether you run FluentBoards at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A privilege escalation flaw in FluentBoards allows subscribers to escalate their account privileges, likely through insufficient role and capability checks. The vulnerability is present in versions 2.0.12 and earlier, accessible to authenticated users with subscriber-level access. An attacker can exploit this to perform actions reserved for higher-privileged roles such as administrators or moderators.

## Affected products

- FluentBoards FluentBoards up to 2.0.12

## Timeline

- 2026-09-30: disclosed

## References

- [https://wordpress.org/plugins](https://wordpress.org/plugins)
- [https://patchstack.com/database/wordpress/plugin/fluent-boards/vulnerability/wordpress-fluentboards-plugin-2-0-12-privilege-escalation-vulnerability?_s_id=cve](https://patchstack.com/database/wordpress/plugin/fluent-boards/vulnerability/wordpress-fluentboards-plugin-2-0-12-privilege-escalation-vulnerability?_s_id=cve)

## Related threats

- [FluentBoards privilege escalation in board management](https://junglewise.ai/threats/cve-2026-89328-fluentboards-privilege-escalation-in-board-management)
- [FluentBoards comment author spoofing via comment_by parameter](https://junglewise.ai/threats/cve-2026-89327-fluentboards-comment-author-spoofing-via-comment-by-parameter)
- [FluentBoards WordPress plugin authorization bypass in board membership](https://junglewise.ai/threats/cve-2026-85349-fluentboards-wordpress-plugin-authorization-bypass-in-board)
- [FluentBoards WordPress plugin insecure direct object reference in board import](https://junglewise.ai/threats/cve-2026-14938-fluentboards-wordpress-plugin-insecure-direct-object-reference-in)