The flaw is a missing authorization check in the FluentBoards plugin. Because the plugin does not properly validate a user’s permissions, any authenticated user can elevate privileges or access data intended for higher‑level administrators. Attackers can read, add, edit, or delete board entries, potentially exposing sensitive information. The impact can include unauthorized data modification and disclosure. Based on the description, it is inferred that the vulnerability can be leveraged by any user with legitimate authentication in WordPress, requiring no additional privilege escalation.

This weakness affects the WordPress plugin FluentBoards from WP ManageNinja LLC. All releases up to and including version 2.1.0 are vulnerable. The plugin runs in any WordPress installation that has it installed.

The CVSS score is 5.4, indicating moderate severity. The EPSS score is not available, and the flaw is not listed in the CISA KEV catalog. The likely attack vector is authenticated access to the WordPress admin interface; an attacker who gains or already possesses user credentials can trigger the broken access control. Because the flaw requires minimal access complexity, the probability of exploitation is moderate, but administrators should treat it as a potential risk requiring remediation.