FluentCommunity EUVD-2026-104256

Exploitation requires an authenticated session on the target WordPress site with the FluentCommunity plugin (version n/a through 2.11.0) installed and active - per CVSS PR:L the attacker must already hold a low-privileged account such as a registered community member, which on sites allowing open registration is a low bar. No user interaction is needed (UI:N) and the request is remote over the network (AV:N). Limiting factors: the attacker cannot act fully unauthenticated, impact is capped at low confidentiality disclosure with no write or denial capability (I:N/A:N), and the specific plugin endpoint/feature lacking the authorization check is not detailed in the input, so the precise data exposed depends on which access-controlled resource is affected.

This is a moderate-severity Missing Authorization flaw (CWE-862) with CVSS 4.3, and the signals are internally consistent: the vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N describes a network-reachable, low-complexity issue that nonetheless requires PR:L - an already-authenticated low-privileged user (e.g. a registered community member) - and yields only low confidentiality impact with no integrity or availability effect. There is no EPSS score, no CISA KEV listing, and no public exploit identified at time of analysis, so there is no evidence of active or at-scale exploitation. The practical picture is a bounded horizontal/limited-vertical access-control gap, not a pre-auth remote compromise: the PR:L requirement and C:L/I:N/A:N impact ceiling mean an authenticated user can likely read data or reach functionality they should not, but cannot modify data or take down the site through this flaw alone. Net: a real but low-priority issue relative to critical pre-auth plugin bugs - patch in routine cycles rather than as an emergency. Note the input Tag 'Authentication Bypass' is imprecise; the CWE and description indicate broken access control / missing authorization (an authenticated user exceeding their authorization), not an authentication bypass - the CVSS PR:L confirms the attacker is authenticated.

An attacker registers or already holds a low-privileged account on a WordPress site running FluentCommunity ≤ 2.11.0, then sends a crafted request to a plugin endpoint that fails to enforce proper authorization checks, allowing them to read or reach data and functionality intended for higher-privileged roles. No public exploit code is identified at time of analysis, and the impact is limited to low confidentiality disclosure (C:L) with no data modification.