Unauthenticated Media Deletion Vulnerability in kboard WordPress Plugin
CVE-2026-88910
Currently unrated
Key Information:
Badges
👾 Exploit Exists🟡 Public PoC
What is CVE-2026-88910?
The kboard WordPress plugin is susceptible to a vulnerability that permits unauthenticated attackers to delete uploaded media files without appropriate verification of ownership or context. This issue stems from the inability of the plugin to validate user permissions, allowing malicious users to exploit the system by iterating through identifiers to permanently erase media files and their corresponding entries in the database.
Affected Version(s)
kboard 0 < 6.7
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.