CVE-2026-3666

There is a vulnerability in wpForo Forum versions up to 3.1.0 related to unauthenticated broken authentication.

There is an unauthenticated PHP Object Injection vulnerability in wpForo Forum versions <= 3.1.0.

There is an unauthenticated SQL injection vulnerability in wpForo Forum versions up to 3.0.4.

The wpForo Forum plugin for WordPress has missing authorization, allowing exploitation of incorrectly configured access control security levels.

The wpForo Forum plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'telegram' profile field in versions up to and including 3.1.6. The raw $_POST['data'] array is copied into $custom_fields before validate() and sanitize() run, leaving it unsanitized when persisted.

Cross Site Scripting (XSS) vulnerability in the wpForo Forum plugin in versions up to and including 3.1.5. The vulnerability can be exploited by a user with Subscriber privileges.

The wpForo Forum plugin for WordPress in versions up to and including 3.1.5 is vulnerable to authorization bypass due to improper verification of user authorization. An authenticated attacker with subscriber-level access or higher can take over another guest author's forum post and modify its title, body, author name, and stored owner email address.

The wpForo Forum plugin for WordPress up to version 2.4.17 is vulnerable to SQL Injection via the 'referer' parameter. Insufficient escaping and lack of preparation on the SQL query allow unauthenticated attackers to append additional SQL queries, which can be used to extract sensitive information from the database.

The wpForo Forum WordPress plugin before 3.1.3 does not restrict which profile fields a member may set when editing their own account. This allows subscriber-level users to write administrator-controlled account-state and reputation fields on their own profile, including self-activating a pending or banned account and forging their forum reputation score.

The wpForo Forum WordPress plugin before 3.1.2 does not sanitize and escape a user profile field before outputting it inside an HTML attribute on the public participant profile page, allowing users with a subscriber-level account to inject JavaScript that executes in the browser of any visitor who views the profile, including a logged-in administrator.