WordPress plugin FluentBoards suffers from an Insecure Direct Object Reference (IDOR) flaw that allows an attacker to bypass authorization controls by supplying a user‑controlled key. This leads to unauthorized access to, edit, or delete resources such as boards, tasks, or other object types governed by the plugin. The weakness is classified as CWE‑639.

Affected is the FluentBoards plugin for WordPress, authored by Mahmudul Hasan Arif. All releases up to and including version 1.91.2 are vulnerable. No specific patch version is listed in the CNA data.

Given that the EPSS score is not available and the vulnerability is not listed in CISA KEV, the risk remains unquantified; however, exploitation requires only moderate effort. Based on the description, it is inferred that an attacker can construct requests with guessed or enumerated object identifiers to read or manipulate protected data. The likely attack vector is remote via the web, assuming the attacker can access the WordPress site. No evidence of active exploitation is reported, but the flaw enables privilege escalation within the WordPress installation.