CVE-2026-119164
HighCVSS 7.5Exploitation Probability (EPSS)
Low risk32th percentile - higher than 32% of all known CVEs
Summary
The wpForo Forum plugin for WordPress in versions up to and including 3.2.2 is vulnerable to privilege escalation via the data[secondary_groupids] parameter in the wpforo_action_profile_update POST handler. A type-confusion flaw in the authorization guard within Members::update() allows an authenticated attacker with Subscriber-level access and above to escalate to wpForo Administrator by injecting the Admin group ID. Exploitation requires at least 3 approved posts and a valid nonce from the user's profile form.
Risk Assessment
A low-privileged authenticated user can gain administrative control over the forum, alter permission policies, and edit other users' content.
Recommendation
Update the wpForo Forum plugin to a version later than 3.2.2 and consider restricting registration capabilities and reviewing group permissions.
Other vulnerabilities in wpForo Forum
See all- CVE-2026-49767Critical
There is a vulnerability in wpForo Forum versions up to 3.1.0 related to unauthenticated broken authentication.
- CVE-2026-49769Critical
There is an unauthenticated PHP Object Injection vulnerability in wpForo Forum versions <= 3.1.0.
- CVE-2026-40798Critical
There is an unauthenticated SQL injection vulnerability in wpForo Forum versions up to 3.0.4.
- CVE-2026-42682Critical
The wpForo Forum plugin for WordPress has missing authorization, allowing exploitation of incorrectly configured access control security levels.
- CVE-2026-95870High
The wpForo Forum plugin for WordPress in versions up to and including 3.2.1 is vulnerable to SQL injection via the 'data' parameter due to insufficient escaping of user input and lack of proper preparation of the SQL query. An unauthenticated attacker can append additional SQL queries to extract sensitive information from the database, provided a searchable topic form field of type checkbox or a select/autocomplete field with isMultiChoice is registered in the forum configuration.
- CVE-2026-120532Medium
The wpForo Forum plugin for WordPress in versions up to and including 3.2.2 is vulnerable to Stored Cross-Site Scripting via the 'post[body]' parameter due to insufficient input sanitization and output escaping. Authenticated attackers with subscriber-level access or higher can inject arbitrary web scripts that execute when a user accesses an injected page.
- CVE-2026-119155High
The wpForo Forum plugin for WordPress in versions up to and including 3.2.2 is vulnerable to time-based SQL injection via the 'href[locale]' parameter due to insufficient escaping of user input and lack of proper preparation of the SQL query. An unauthenticated attacker can append additional SQL queries to extract sensitive information from the database; the required nonce is publicly issued on any forum page.
- CVE-2026-110004Medium
The wpForo Forum plugin for WordPress (up to version 3.2.2) is vulnerable to arbitrary file deletion due to insufficient file path validation in the theme_delete function. An authenticated attacker with Subscriber-level access can delete arbitrary files on the server, potentially leading to remote code execution. This requires an administrator to have created a custom group with a blank role and the 'mth' capability.
- CVE-2026-93747Medium
The wpForo Forum plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'telegram' profile field in versions up to and including 3.1.6. The raw $_POST['data'] array is copied into $custom_fields before validate() and sanitize() run, leaving it unsanitized when persisted.
- CVE-2026-93772Medium
Cross Site Scripting (XSS) vulnerability in the wpForo Forum plugin in versions up to and including 3.1.5. The vulnerability can be exploited by a user with Subscriber privileges.
Original NVD description (English source)
The wpForo Forum plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 3.2.2 via the `data[secondary_groupids]` parameter of the `wpforo_action_profile_update` POST handler. This is due to a type-confusion flaw in the secondary_groupids authorization guard within the `Members::update()` function in `classes/Members.php`, where casting a scalar CSV string (e.g. `"0,1"`) with `(array)` before `array_map('intval', …)` and `array_filter()` produces an empty array — causing the guard's outer conditional, and the else-branch that would otherwise strip the field from the update, to be bypassed entirely — while `encode()`/`decode()` downstream correctly explodes the original CSV and persists the attacker-supplied group IDs to `wp_wpforo_profiles.secondary_groupids`. This makes it possible for authenticated attackers, with Subscriber-level access and above, to escalate their forum privileges to wpForo Administrator by injecting the privileged Admin group ID, granting access to the Forum Accesses editor and the ability to rewrite forum-wide capability policies for all members and edit arbitrary content owned by other users. Exploitation requires the attacker to have at least 3 approved wpForo posts to satisfy the plugin's default `min_number_posts_to_edit_account` antispam gate, along with a valid wpforo nonce obtained from their own account profile form.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS