CVE-2026-89327

FluentBoards < 2.0.15 - Board Member+ Comment Author Spoofing via 'comment_by' Parameter

The FluentBoards WordPress plugin before 2.0.15 does not verify that a board member submitting a comment is the user the comment is attributed to, allowing any board member to post comments that appear to be authored by another user, including administrators.

Affected

FluentBoards

CVSS v3.1 CNA

3.8 LOWCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N

EPSS

0.26% chance of exploitation in the next 30 days, 16th percentile

Published

2026-09-16

Updated

2026-09-17

Proof-of-concept exploits (1)

• https://wpscan.com/vulnerability/aaeff6e8-eca5-4d93-8214-670f1728fb0e/

References

• CVE Record
• NVD entry