CVE-2026-80514

MediumCVSS 5.3

Published: 25/09/2026(UTC)Updated: 25/09/2026(UTC)Translated: 25/09/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.16%

4th percentile - higher than 4% of all known CVEs

Summary

The wpForo Forum WordPress plugin from 3.0.0 before 3.1.6 does not verify the source of client-supplied IP address headers before using them to key its per-visitor rate limit on paid AI requests. This allows unauthenticated attackers to bypass the limit by spoofing the header and exhaust the site owner's metered AI credits.

Risk Assessment

An attacker can exhaust the organization's paid AI credits, generating uncontrolled costs. This may also lead to denial of service for legitimate users.

Recommendation

Update the wpForo Forum plugin to version 3.1.6 or later. Consider monitoring AI credit usage and implementing additional protections against IP header spoofing.

Other vulnerabilities in wpForo Forum WordPress plugin

CVE-2026-80513High
The wpForo Forum WordPress plugin before 3.1.6 does not restrict which classes may be instantiated when it deserializes a user-supplied profile field value, allowing authenticated users with Subscriber-level access and above to inject a PHP Object. No POP chain is present in the plugin itself; if one is present via another installed plugin, this could lead to remote code execution, arbitrary file operations, or SQL injection. This is an incomplete fix of CVE-2026-49769.

Original NVD description (English source)

The wpForo Forum WordPress plugin from 3.0.0 before 3.1.6 does not verify the source of client-supplied IP address headers before using them to key its per-visitor rate limit on paid AI requests, allowing unauthenticated attackers to bypass the limit by spoofing the header and exhaust the site owner's metered AI credits.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS