Fluent Boards Pro EUVD-2026-66938

Exploitation requires an authenticated WordPress Editor-level account (or higher) on a site running Fluent Boards Pro 2.0.11 or earlier - this is the specific privilege confirmed by the CVSS PR:H metric. The vulnerability is triggered through the plugin's editor file management functionality, meaning the Fluent Boards Pro plugin must be installed and active. The degree of filesystem damage depends on the OS-level permissions of the web server process: environments where PHP/Apache/Nginx runs with broad write access amplify impact significantly. Exploitation is limited by: (1) the requirement for a valid Editor (or higher) WordPress credential, (2) the need for the plugin to be installed and active, and (3) host filesystem permission configurations that may restrict writes outside the webroot. Default WordPress hardened configurations (e.g., read-only filesystem mounts) would limit scope.

The CVSS 3.1 base score of 6.8 is driven by network attack vector (AV:N), low complexity (AC:L), changed scope (S:C), and high availability impact (A:H), partially offset by the high privilege requirement (PR:H). In practice, PR:H maps to the WordPress 'Editor' role - a non-trivial but achievable privilege level that can be held by content contributors or compromised via credential theft. The S:C rating is a significant signal: this is not merely a self-destructive action limited to the plugin's own files; it can cascade to affect the underlying host. No EPSS data was provided in the input and no KEV listing exists, indicating no confirmed widespread exploitation. The absence of a POC and the high privilege bar lower immediate mass-exploitation risk, but insider threat or post-compromise scenarios remain realistic. The I:N metric in the provided vector is arguably understated - file deletion constitutes a form of data destruction that many practitioners would score as I:H alongside A:H; this discrepancy should be verified with the vendor advisory.

An attacker with a WordPress Editor account - obtained through credential stuffing, phishing, or insider access - submits a crafted file deletion request to the Fluent Boards Pro editor endpoint, embedding a path traversal sequence (e.g., '../../../../../../etc/passwd' or targeting WordPress configuration files such as wp-config.php). The plugin processes the path without sanitization and deletes the target file, potentially taking the site or server offline. No public exploit code has been identified at time of analysis, but the attack requires no special tooling beyond a standard HTTP client.