The FluentBoards WordPress plugin before version 2.0.15 does not correctly verify that a user has board‑manager privileges before performing several board‑management operations, instead checking only board membership. This flaw allows any board member to carry out manager‑only actions, such as adding or removing members and enabling public access to a private board, thereby granting unauthorized manipulation of board contents and exposure of information that should remain private.

The vulnerability affects the FluentBoards WordPress plugin for any release prior to 2.0.15, such as 2.0.14 and earlier. WordPress sites that have installed these vulnerable versions are at risk of exploitation.

The EPSS score is below 1 %, indicating a low probability of observed exploitation, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is an authenticated remote web request to the plugin’s administration endpoints; based on the description, the attack requires an authenticated WordPress user who is a member of a board. No external network component is needed beyond normal WordPress traffic. While public exploitation is unlikely, the impact of successful exploitation is significant: an attacker can alter board membership and expose private boards to the public.