CVE-2026-127215: Kanbanz WordPress Plugin < 1.0.3 Broken Access Control via admin-ajax Handlers

Q: Who can exploit this issue?

An authenticated user with the Kanban Staff role can exploit it. The attacker does not need to be a member of the targeted board or team.

Q: Does exploitation require user interaction or a complex attack setup?

No user interaction is required, and the listed attack complexity is low. Exploitation is performed through affected admin-ajax handlers using attacker-supplied board_id or task_id parameters.

Q: What can an attacker do on boards they do not belong to?

They can read task data and modify board content, including status columns, subtasks, labels, and comments. They can also upload or delete attachments, create tasks, and set WIP limits on other teams' boards.

Q: Which deployments should be treated as affected?

Kanbanz WordPress Plugin versions before 1.0.3 are affected. Environments that assign users the Kanban Staff role should treat cross-board access as potentially exposed.

Q: How can administrators identify possible exploitation?

Review board and task activity for changes made by Kanban Staff accounts that were not members of the affected board. Look for unexpected task reads or edits, comments, attachment uploads or deletions, newly created tasks, altered status columns or labels, and WIP-limit changes on other teams' boards.

Published Nov 13, 2026

Updated

Kanbanz by Softaculous plugin for WordPress before 1.0.3 contains a broken access control vulnerability that allows authenticated Kanban Staff users to access and modify boards they are not members of by exploiting admin-ajax handlers that fail to call kanbanzusercanaccessboard() or per-task edit checks on attacker-supplied boardid or taskid parameters. Attackers can supply arbitrary board IDs to read sensitive task data, overwrite status columns, subtasks, and labels, inject comments, upload or delete attachments, and create tasks or set WIP limits on boards owned by other teams.

Affected Software

1 affected component

Softaculous Kanbanz WordPress Plugin<1.0.3

Event History

Nov 13, 2026

CVE Published

via MITRE·08:10 PM

Data Sourced

via MITRE·08:10 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Who can exploit this issue?

An authenticated user with the Kanban Staff role can exploit it. The attacker does not need to be a member of the targeted board or team.

Does exploitation require user interaction or a complex attack setup?

No user interaction is required, and the listed attack complexity is low. Exploitation is performed through affected admin-ajax handlers using attacker-supplied board_id or task_id parameters.

What can an attacker do on boards they do not belong to?

They can read task data and modify board content, including status columns, subtasks, labels, and comments. They can also upload or delete attachments, create tasks, and set WIP limits on other teams' boards.

Which deployments should be treated as affected?

Kanbanz WordPress Plugin versions before 1.0.3 are affected. Environments that assign users the Kanban Staff role should treat cross-board access as potentially exposed.

How can administrators identify possible exploitation?

Review board and task activity for changes made by Kanban Staff accounts that were not members of the affected board. Look for unexpected task reads or edits, comments, attachment uploads or deletions, newly created tasks, altered status columns or labels, and WIP-limit changes on other teams' boards.

CVE-2026-127215: Kanbanz WordPress Plugin < 1.0.3 Broken Access Control via admin-ajax Handlers

Affected Software

Event History

Frequently Asked Questions

Who can exploit this issue?

Does exploitation require user interaction or a complex attack setup?

What can an attacker do on boards they do not belong to?

Which deployments should be treated as affected?

How can administrators identify possible exploitation?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this issue?

Does exploitation require user interaction or a complex attack setup?

What can an attacker do on boards they do not belong to?

Which deployments should be treated as affected?

How can administrators identify possible exploitation?