VulnSocial

CVE-2026-7523Disclosure

LOWCVSS 4.3 · MEDIUM

Exploit discussion active in current signal (1 latest mentions)

Immediate actions

  • Hunt for exploitation attempts and persistence artifacts
  • Increase monitoring for publicly documented tradecraft
  • Track advisory updates for patch or workaround availability

Recommended action window: High priority (within 72h)

NVD description

The Alba Board plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.1.3. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with subscriber-level access and above, to access arbitrary private alba_card post data, including title, description, assignee, due date, tags, and comments, that is intended to be restricted to Administrators and Editors. The handler is registered via the wp_ajax_nopriv_ hook and its nonce is exposed to all site visitors through wp_localize_script on pages containing the [alba_board] shortcode, making this exploitable by unauthenticated users who can access any such page.

Back to dashboard
1.5/ 10 priority

Sources & remediation

Other references
Weakness type (CWE)
CWE-862

Priority

LOW

Exploitation

NONE

PoC

YES

Patch

NONE

Momentum

STABLE

Threat summary

  • Public PoC is present in monitored signal
  • 3 mentions across 2 observed days
  • Momentum state: stable

What's happening

  • PoC mentioned or linked in 1 signal
  • Technical details provided in 3 signals
  • Disclosure: 2 classified signals
  • Peaked 1d ago at 2 mentions (2026-06-07); latest day: 1
  • 3 total mentions across 2 days

Deep dive

Activity timeline3 mentions / 2d
01122Mentions · 2026-06-07: 2Mentions · 2026-06-13: 1PoC Mentioned / Linked · 2026-06-13: 1Technical Details · 2026-06-07: 2Technical Details · 2026-06-13: 106-0706-13
Signal classification2 categories
Disclosure
266.7%
PoC
133.3%
Referenced assets3 URLs
Classification over time
DateTotalLabels
2026-06-072
Disclosure2
2026-06-131
PoC1
Full discourse3 posts
  • Atomic Edge@atomicedgeWAF
    PoC

    https://atomicedge.io/cve-proof/cve-2026-7523-alba-board-version-2-1-3-medium-vulnerability-proof-of-concept CVE-2026-7523 alba-board (CVSS Score 4.3) #WordPress plugin #vulnerability #cybersecurity #wordpressfirewall #wordpresssecurity #hacking #wpsecurity #atomicedge #cybers…

    Post summary

    The post highlights a proof‑of‑concept for CVE‑2026‑7523, noting its CVSS score, but it does not provide exploit code, active exploitation evidence, or patch information.

    0000033
    9 followersView on X
  • Infoflowcloud@infoflowcloud
    Disclosure

    🚨*CVE* CVE-2026-7523 The Alba Board plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.1.3. This is due to the plugin not properly verifying … https://www.cve.org/CVERecord?id=CVE-2026-7523 ----- Traducción: CVE-2026-7523 El … http://infoflow.cloud`

    Post summary

    An alert detailing CVE-2026-7523, a WordPress plugin authorization bypass, is provided with a link to the official CVE record but no PoC, exploit, patch, or active exploitation claim.

    0000022
    79 followersView on X
  • CVE@CVEnew
    Disclosure

    CVE-2026-7523 The Alba Board plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.1.3. This is due to the plugin not properly verifying … https://www.cve.org/CVERecord?id=CVE-2026-7523

    Post summary

    The post discloses an authorization bypass vulnerability in the Alba Board WordPress plugin (up to 2.1.3) with no PoC, exploit, or patch detailed.

    00000296
    57.6K followersView on X

Explore more

Back to dashboard