The vulnerability lies in the FluentBoards WordPress plugin, where the public, token‑shared board feature fails to restrict the member data it returns. This allows an unauthenticated user to fetch the email addresses of all board members, including administrators, which can be used for phishing or account takeover. The weakness is an information‑exposure flaw.

Any WordPress site using FluentBoards versions prior to 2.1.0, particularly those that expose a token in public board URLs, are vulnerable. The plugin returns a JSON payload containing member data via a publicly accessible endpoint without authentication checks.

The CVSS score of 5.3 indicates medium severity, and the EPSS score of less than 1% indicates a very low exploit probability. The vulnerability is not listed in CISA KEV. Attackers can perform a simple HTTP GET request to the board endpoint with the shared token to receive the list of email addresses. Operators should address the issue promptly.