FluentBoards versions up to 1.47 allow deserialization of data from untrusted sources, enabling an attacker to instantiate objects of arbitrary classes through PHP object injection. This flaw can lead to arbitrary code execution, allowing attackers to gain full control over the affected WordPress site. The weakness is classified as CWE‑502, Deserialization of Untrusted Data.

The vulnerability affects the FluentBoards plugin developed by Mahmudul Hasan Arif. All releases from the earliest available version up to and including version 1.47 are impacted. WordPress sites utilizing any of these plugin versions are potentially compromised.

The CVSS score of 9.8 marks this as a critical threat, while the EPSS score of less than 1% indicates that the general exploitation rate is low but still possible. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires the ability to deliver crafted serialized data to the plugin, implying the likely attack vector is remote via HTTP requests that pass user-supplied parameters to the plugin’s deserialization routines.