CVE-2026-42682

CriticalCVSS 9.1

Published: 01/06/2026(UTC)Updated: 22/07/2026(UTC)Translated: 23/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.29%

21th percentile - higher than 21% of all known CVEs

Summary

The wpForo Forum plugin for WordPress has missing authorization, allowing exploitation of incorrectly configured access control security levels.

Risk Assessment

An attacker can gain access to administrative functions or data they should not have access to.

Recommendation

Update wpForo Forum to version 3.0.7 or later, which includes the fix.

Original NVD description (English source)

Missing Authorization vulnerability in Tomdever wpForo Forum allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects wpForo Forum: from n/a through 3.0.6.