An arbitrary file upload flaw in the WordPress Fluent Boards Pro plugin allows an attacker to upload any file, potentially including malicious scripts, which can then be executed on the WordPress site. This flaw provides a direct path to remote code execution, giving an attacker full control over the server if the uploaded file is executed. The vulnerability is classified under CWE-434 and is rated as critical.

The flaw exists in the WP Manage Ninja: Fluent Boards Pro plugin in all releases up to and including version 2.0.11. Users running any of those affected versions via WordPress should verify their installed plugin version.

The CVSS score of 9.1 indicates a high likelihood of severe impact. Because EPSS data is not available, there is no quantified exploitation probability, and the vulnerability is not yet listed in the CISA KEV catalog, which may suggest limited current exploitation. However, the nature of the flaw—arbitrary file upload—makes it highly susceptible to exploitation via the web interface, and attackers could leverage it if an attacker is able to submit a file through the plugin's upload mechanism.