CVE-2026-110004
MediumCVSS 6.5Exploitation Probability (EPSS)
Elevated risk54th percentile - higher than 54% of all known CVEs
Summary
The wpForo Forum plugin for WordPress (up to version 3.2.2) is vulnerable to arbitrary file deletion due to insufficient file path validation in the theme_delete function. An authenticated attacker with Subscriber-level access can delete arbitrary files on the server, potentially leading to remote code execution. This requires an administrator to have created a custom group with a blank role and the 'mth' capability.
Risk Assessment
An attacker could delete critical files such as wp-config.php, potentially leading to site takeover or destruction.
Recommendation
Update the wpForo plugin to the latest version and remove custom groups with the 'mth' capability and blank role.
Other vulnerabilities in wpForo Forum
See all- CVE-2026-49767Critical
There is a vulnerability in wpForo Forum versions up to 3.1.0 related to unauthenticated broken authentication.
- CVE-2026-49769Critical
There is an unauthenticated PHP Object Injection vulnerability in wpForo Forum versions <= 3.1.0.
- CVE-2026-40798Critical
There is an unauthenticated SQL injection vulnerability in wpForo Forum versions up to 3.0.4.
- CVE-2026-42682Critical
The wpForo Forum plugin for WordPress has missing authorization, allowing exploitation of incorrectly configured access control security levels.
- CVE-2026-95870High
The wpForo Forum plugin for WordPress in versions up to and including 3.2.1 is vulnerable to SQL injection via the 'data' parameter due to insufficient escaping of user input and lack of proper preparation of the SQL query. An unauthenticated attacker can append additional SQL queries to extract sensitive information from the database, provided a searchable topic form field of type checkbox or a select/autocomplete field with isMultiChoice is registered in the forum configuration.
- CVE-2026-120532Medium
The wpForo Forum plugin for WordPress in versions up to and including 3.2.2 is vulnerable to Stored Cross-Site Scripting via the 'post[body]' parameter due to insufficient input sanitization and output escaping. Authenticated attackers with subscriber-level access or higher can inject arbitrary web scripts that execute when a user accesses an injected page.
- CVE-2026-119164High
The wpForo Forum plugin for WordPress in versions up to and including 3.2.2 is vulnerable to privilege escalation via the data[secondary_groupids] parameter in the wpforo_action_profile_update POST handler. A type-confusion flaw in the authorization guard within Members::update() allows an authenticated attacker with Subscriber-level access and above to escalate to wpForo Administrator by injecting the Admin group ID. Exploitation requires at least 3 approved posts and a valid nonce from the user's profile form.
- CVE-2026-119155High
The wpForo Forum plugin for WordPress in versions up to and including 3.2.2 is vulnerable to time-based SQL injection via the 'href[locale]' parameter due to insufficient escaping of user input and lack of proper preparation of the SQL query. An unauthenticated attacker can append additional SQL queries to extract sensitive information from the database; the required nonce is publicly issued on any forum page.
- CVE-2026-93747Medium
The wpForo Forum plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'telegram' profile field in versions up to and including 3.1.6. The raw $_POST['data'] array is copied into $custom_fields before validate() and sanitize() run, leaving it unsanitized when persisted.
- CVE-2026-93772Medium
Cross Site Scripting (XSS) vulnerability in the wpForo Forum plugin in versions up to and including 3.1.5. The vulnerability can be exploited by a user with Subscriber privileges.
Original NVD description (English source)
The wpForo Forum plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the theme_delete function in all versions up to, and including, 3.2.2 This makes it possible for authenticated attackers, with subscriber-level access and above, to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php). This exploit chain is reachable only on sites where an administrator has created a custom wpForo secondary usergroup with a blank WordPress role and the 'mth' (Manage Themes) capability; on such sites, an attacker can self-register and claim that group via the unguarded wpforo_secondary_groupids[] POST field, bypassing the role-based group filter and gaining theme-management access as a Subscriber.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS