This vulnerability (CVE-2026-78278) involves an authorization bypass due to insecure direct object references (CWE-639) in Fluent Boards Pro versions <= 2.0.11. An attacker can exploit this flaw by controlling keys used to access subscriber data, potentially gaining unauthorized read access. The CVSS 3.1 base score is 5.3, reflecting network attack vector, low complexity, no privileges required, no user interaction, and limited confidentiality impact. No vendor advisory or patch information is currently available.

The impact is limited to unauthorized disclosure of subscriber data due to improper authorization checks. There is no indication of integrity or availability impact. The vulnerability could allow an attacker to access data they should not have permission to view, but does not enable privilege escalation or data modification.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the affected plugin and monitor for unusual access patterns related to subscriber data. Avoid exposing the plugin to untrusted users if possible.