The Alba Board WordPress plugin allows an authenticated user with subscriber-level access or any visitor to retrieve private card information, including title, description, assignee, due date, tags, and comments, through a publicly exposed AJAX endpoint. This flaw is a classic authorization bypass (CWE-862) that compromises confidentiality by exposing data that should be visible only to administrators and editors. The impact is a data leak of potentially sensitive project or task details.

WordPress sites running the Alba Board plugin by alejo30, versions 2.1.3 and earlier. The vulnerability exists in all releases up to and including 2.1.3, so any site that has not upgraded past this version is affected.

The CVSS score of 4.3 rates the issue as moderate severity. While the EPSS score is not available and the vulnerability is not listed in the CISA KEV catalog, the exposed AJAX endpoint and public nonce mean an attacker can easily gather private card data from any site that displays the [alba_board] shortcode. No authentication or privilege check protects the AJAX handler, so both authenticated subscribers and unauthenticated visitors can exploit the flaw. The risk therefore centers on inadvertent data leakage rather than privilege escalation.