CVE-2026-88910 json
KBoard < 6.7 - Unauthenticated Board Media Deletion via IDOR
published 2026-09-16 54 d ago modified 2026-09-17 52 d ago also EUVD-2026-80213
- cvss
- 5.3
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.3%
- EPSS 0.3% chance of exploitation in 30 days, percentile 23%
- public exploits
- 0
- none known
Summary
The kboard WordPress plugin before 6.7 does not verify ownership or context before deleting board media, allowing unauthenticated attackers to permanently delete its uploaded media files and their database records by iterating identifiers.
Patch / fix
- Unknown kboard 6.7
CISA SSVC
- Exploitation
- none
- Automatable
- yes
- Technical impact
- partial
- Assessed
- 53 d ago
Exploit prediction
0.30% chance of exploitation in the next 30 days, higher than 23% of all scored CVEs (FIRST EPSS, 2026-11-08).
Exploits and checks
- wpscan.com https://wpscan.com/vulnerability/96119ba5-4dcd-4aff-adf9-83f058c3dc6d/ referenced PoC, tagged "exploit" by a source, unverified
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CISA ADP | 3.1 | 5.3 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N |
| CNA | 3.1 | 5.3 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N |
Affected products
- Unknown kboard
Classification
- Weakness
-
- CWE-639 Authorization Bypass Through User-Controlled Key
- Technology feeds
References
-
wpscan.com
/vulnerability/96119ba5-4dcd-4aff-adf9-83f058c3dc6d/
exploit, vdb-entry, technical-description
Sources
- CVE List CVE-2026-88910
- NVD CVE-2026-88910
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.