CVE-2026-88910 — MEDIUM (5.3)

Vulnerability Description

The kboard WordPress plugin before 6.7 does not verify ownership or context before deleting board media, allowing unauthenticated attackers to permanently delete its uploaded media files and their database records by iterating identifiers.

CVSS Score

5.3

MEDIUM

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality

NONE

Integrity

LOW

Availability

NONE

Related Weaknesses (CWE)

CWE-639

References

https://wpscan.com/vulnerability/96119ba5-4dcd-4aff-adf9-83f058c3dc6d/

FAQ

What is CVE-2026-88910?

CVE-2026-88910 is a vulnerability with a CVSS score of 5.3 (MEDIUM). The kboard WordPress plugin before 6.7 does not verify ownership or context before deleting board media, allowing unauthenticated attackers to permanently delete its uploaded media files and their dat...

How severe is CVE-2026-88910?

CVE-2026-88910 has been rated MEDIUM with a CVSS base score of 5.3/10. Review the CVSS metrics above for detailed severity breakdown.

Is there a patch for CVE-2026-88910?

Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.