The vulnerability is an IDOR that allows an authenticated user, even with a low‑privilege Subscriber role, to retrieve the private board memberships of any other user by simply referencing that user's identifier. The plugin fails to enforce proper authorization checks, resulting in the disclosure of sensitive internal data such as private board memberships. This leakage can expose membership details and potentially facilitate social engineering or targeted attacks against board participants.

WordPress sites that use the FluentBoards plugin before version 2.0.15. The issue applies to all installations of this plugin that have not yet been updated to 2.0.15 or later, regardless of other configuration settings.

The EPSS score is lower than one percent, indicating a very low probability of exploitation in the current environment, and the vulnerability is not listed in the CISA KEV catalog. However, any authenticated user with a Subscriber account can trigger the disclosure by accessing the board listing endpoint with the target user’s identifier. The lack of strict authorization checks means that the attacker does not need elevated privileges; possession of a normal login is sufficient.