CVE-2026-7523

Name of the Vulnerable Software and Affected Versions Alba Board versions prior to 2.1.4

Description The plugin fails to properly verify if a user is authorized to perform specific actions, leading to an authorization bypass. This allows authenticated attackers with subscriber-level access or higher to access arbitrary private alba card post data, such as titles, descriptions, assignees, due dates, tags, and comments, which should be restricted to Administrators and Editors. Because the handler is registered via the wp ajax nopriv hook and its nonce is exposed to all site visitors through wp localize script on pages containing the [alba board] shortcode, the issue is also exploitable by unauthenticated users who can access those pages.

Recommendations Update to a version later than 2.1.3.