CVE-2026-80513

HighCVSS 7.5

Published: 24/09/2026(UTC)Updated: 24/09/2026(UTC)Translated: 24/09/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.20%

9th percentile - higher than 9% of all known CVEs

Summary

The wpForo Forum WordPress plugin before 3.1.6 does not restrict which classes may be instantiated when it deserializes a user-supplied profile field value, allowing authenticated users with Subscriber-level access and above to inject a PHP Object. No POP chain is present in the plugin itself; if one is present via another installed plugin, this could lead to remote code execution, arbitrary file operations, or SQL injection. This is an incomplete fix of CVE-2026-49769.

Risk Assessment

An authenticated low-privileged user can inject a PHP object, which combined with another plugin may lead to remote code execution or SQL injection. This poses a risk of full server compromise and data leakage.

Recommendation

Update the wpForo Forum plugin to version 3.1.6 or later. Review installed plugins for POP chains and restrict Subscriber roles where possible.

Other vulnerabilities in wpForo Forum WordPress Plugin

CVE-2026-80514Medium
The wpForo Forum WordPress plugin from 3.0.0 before 3.1.6 does not verify the source of client-supplied IP address headers before using them to key its per-visitor rate limit on paid AI requests. This allows unauthenticated attackers to bypass the limit by spoofing the header and exhaust the site owner's metered AI credits.

Original NVD description (English source)

The wpForo Forum WordPress plugin before 3.1.6 does not restrict which classes may be instantiated when it deserializes a user-supplied profile field value, allowing authenticated users with Subscriber-level access and above to inject a PHP Object. No POP chain is present in the wpForo Forum WordPress plugin before 3.1.6 itself; if one is present via another installed wpForo Forum WordPress plugin before 3.1.6 or , this could lead to remote code execution, arbitrary file operations, or SQL injection. This is an incomplete fix of CVE-2026-49769.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS