The vulnerability in the Shahjahan Jewel FluentCommunity plugin results from missing authorization checks, allowing an attacker to bypass normal access controls. The flaw permits a malicious user to gain unauthorized access to administrative functions, potentially exposing sensitive data and altering site content. This broken access control impact can lead to unauthorized application of changes, data tampering, and other privilege-escalation consequences within the WordPress environment.

FluentCommunity plugins for WordPress from any version up to and including 2.0.0 are affected. Anyone deploying this plugin in a WordPress installation, regardless of site size or configuration, is at risk.

The CVSS score of 4.3 indicates a moderate severity, while the EPSS score of less than 1% suggests a low probability of exploitation in the wild. The vulnerability is not listed in the CISA KEV catalog, implying no known mass exploitation. The likely attack vector is the web interface, where an authenticated or unauthenticated user could manipulate plugin endpoints to bypass restrictions.