This vulnerability arises in the FluentBoards WordPress plugin versions up to 2.0.12, allowing a subscriber-level user to elevate privileges within the plugin. By exploiting the flaw, an attacker could potentially obtain additional permissions such as the ability to modify boards or create new boards, effectively bypassing the intended role restrictions.

The affected product is the FluentBoards plugin for WordPress, developed by Mahmudul Hasan Arif. Versions 2.0.12 and earlier are vulnerable; versions 2.0.15 and later contain the fix.

The CVSS score of 6.3 indicates a moderate severity vulnerability. The EPSS score is not available, so the current exploitation probability is unknown. The vulnerability is not listed in the CISA KEV catalog. Based on the plugin’s nature and the described privilege escalation, the likely attack vector involves a WordPress site with the vulnerable plugin installed, potentially triggered through normal user interaction or a crafted request to the plugin’s API. The attacker requires a subscriber account on the affected site to leverage the flaw.