The vulnerability in the FluentBoards WordPress plugin is an IDOR flaw that allows any authenticated user with member access to a single board to import and view the stages and tasks of any other board on the same WordPress site. Because the plugin does not verify that the items selected for a board import belong to a board the requesting user is authorized to access, an attacker can copy and read the titles, descriptions and file attachments of other boards. The impact is the disclosure of potentially sensitive project data, with no direct effect on board integrity. Based on the description, it is inferred that the flaw allows an attacker to use the board import functionality to read tasks from boards they are not authorized to view.

The flaw affects all FluentBoards WordPress plugin versions prior to 1.95.3. An attacker only needs to be an authenticated member on at least one board; with that access they can target any other board on the same site. No specific WordPress core versions or other plugins are listed as impacted.

The EPSS score is listed as less than 1%, indicating a low likelihood of exploitation in the wild, and the vulnerability is not included in the CISA KEV catalog. However the CVSS score of 4.3 signals a moderate impact for confidentiality. With the prerequisite of member access, the flaw is easily exploitable because the front‑end flow provides no barrier to unauthorized board data retrieval. An attacker who can import a board can read all tasks across all boards, potentially exposing sensitive information. Based on the description, it is inferred that the attacker only needs member access to a single board to trigger the flaw.