CVE-2026-89327CWE-290

CVE-2026-89327

Low · published September 16, 2026

CVSS v3.1
3.8
EPSS
0%
Percentile
16.1
In the wild
Unconfirmed
What it is

The FluentBoards WordPress plugin before 2.0.15 does not verify that a board member submitting a comment is the user the comment is attributed to, allowing any board member to post comments that appear to be authored by another user, including administrators.

The record
Technical detail
CVSS v3.1
3.8 · LOW
Vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00255 · 16.1th percentile
Weakness
CWE-290 · Authentication Bypass by Spoofing
Published
2026-09-16T10:16Z
References (1)
https://wpscan.com/vulnerability/aaeff6e8-eca5-4d93-8214-670f1728fb0e/ · [email protected]
EPSS history
Timeline
  • 17 SEP 03:33Z
    EPSS moved — → 0%
    epss
  • 16 SEP 06:00Z
    FluentBoards < 2.0.15 - Board Member+ Comment Author Spoofing via 'comment_by' Parameter
    cvelistv5