The issue is a missing authorization flaw that lets an attacker exploit incorrectly configured access control security levels in the WP Discussion Board plugin. This defect permits users to perform actions they are not permitted to, such as creating, editing, or deleting discussion board content, thereby undermining the integrity of posts and potentially exposing sensitive forum data. The weakness is a classic access‑control failure (CWE‑862).

The vulnerability affects installations of the WP Discussion Board WordPress plugin up to and including version 2.6.0. Users running any earlier or the default version of the plugin are susceptible; newer releases beyond 2.6.0 are not affected.

The CVSS score of 5.3 classifies the flaw as moderate severity. Because the EPSS score is not available, the current exploitation likelihood is unknown, and the vulnerability is not listed in the CISA KEV catalog. Attacks are likely to occur through the web interface, targeting authenticated users who can trigger privileged actions that exceed their assigned roles. If the plugin is exposed to the public internet, an attacker could compromise the discussion board’s content or privacy without needing administrative privileges.