Broken Access Control in Kanbanz Plugin for WordPress by Softaculous

CVE-2026-127215

What is CVE-2026-127215?

The Kanbanz plugin for WordPress developed by Softaculous prior to version 1.0.3 is susceptible to a broken access control flaw. Authenticated users with Kanban Staff privileges can exploit this vulnerability to access and modify boards outside of their authorized permissions. By manipulating parameters such as board_id and task_id in admin-ajax handlers that bypass necessary access control checks, attackers can view sensitive data, alter board statuses, inject comments, and even manipulate task assignments. This compromises the integrity of project management boards, posing significant risks to data confidentiality and operational integrity.

References