The vulnerability in the FluentCommunity plugin is a missing authorization check that can be exploited by incorrectly configured access control levels. This flaw allows a user to perform privileged actions they are not authorized to execute, which can lead to unauthorized data modification or disclosure. The weakness is classified as CWE‑862 and its impact is limited to the confidentiality and integrity of the WordPress site data, potentially affecting all users of the plugin.

The affected product is the WordPress FluentCommunity plugin from WP ManageNinja LLC, version 2.11.0 and earlier. Any site running an affected version of the plugin is at risk, regardless of the number of users or the specific WordPress installation configuration.

The CVSS score of 4.3 indicates a medium severity with moderate impact on the affected system. No EPSS score is available, and the vulnerability is not listed in the CISA KEV catalog, suggesting a lower likelihood of widespread exploitation. Based on the description, it is inferred that the attack vector requires valid authentication but is enabled by a broken access control check, allowing any authenticated user to access privileged functions.