Fluent Boards Pro EUVD-2026-66937

Exploitation requires an authenticated WordPress account with the Editor role or higher (CVSS PR:H), reachable over the network with no user interaction and low complexity. The concrete prerequisite is access to the Fluent Boards Pro file-upload/editor feature that performs the unrestricted upload; the site must have Fluent Boards Pro <= 2.0.11 installed and active. Limiting factors: it is NOT exploitable by anonymous or low-privilege (Subscriber/Contributor) users, so single-admin sites with no untrusted editors face little practical risk, whereas multi-author, agency, or membership sites that hand out Editor accounts are directly exposed.

The CVSS 3.1 vector (AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H) shows a network-reachable, low-complexity flaw with high confidentiality, integrity, and availability impact and a scope change - consistent with upload-to-RCE. The critical mitigating signal is PR:H: exploitation requires an authenticated account with Editor privileges, which meaningfully narrows the realistic attacker set to insiders, compromised editor credentials, or multi-author sites. No EPSS score, KEV listing, or POC is present in the provided data, so there is no evidence of active exploitation or widespread automated weaponization; the priority here rests on the severity of outcome (RCE) rather than proven mass exploitation. Net assessment: a genuinely serious flaw for any WordPress site that grants Editor accounts to semi-trusted users, but the privilege requirement makes it targeted rather than internet-wide, so patch promptly but it is not an emergency for single-admin installations.

An attacker who has obtained or been granted an Editor account logs into the WordPress admin and uses the Fluent Boards Pro upload feature to submit a PHP web shell disguised as a permitted file type. The plugin stores it in a web-reachable path, and the attacker then requests that URL to execute commands on the server. With AV:N/AC:L the request is straightforward once authenticated, but PR:H means the whole chain hinges on first holding editor-level access.