The vulnerability is a missing authorization flaw in the Marketing Fire Discussion Board WordPress plugin, where incorrect access control security levels permit users to perform actions they should not be able to. This broken access control can enable an attacker to read, edit, or delete private discussion content and other protected data. The weakness is identified as CWE‑862, indicating a failure to enforce proper user authentication or authorization decisions.

WordPress sites installing the Marketing Fire Discussion Board plugin with a version up to and including 2.5.7 are impacted. Versions before the first release are also affected. No specific sub‑versions are listed, so all 2.5.7 and earlier builds are at risk.

The CVSS score of 4.3 reflects moderate severity, and the EPSS score of less than 1% indicates a low probability of exploitation at the time of this analysis. The plugin is not listed in the CISA KEV catalog, suggesting no documented widespread exploitation. Attackers likely need to authenticate through a WordPress account that has the ability to access the plugin’s administrative interface or any misconfigured access level that elevates privileges. Once authenticated, the attacker can exploit the broken access control to alter or exfiltrate discussion content.