CVE-2026-91092

There is a vulnerability in wpForo Forum versions up to 3.1.0 related to unauthenticated broken authentication.

There is an unauthenticated PHP Object Injection vulnerability in wpForo Forum versions <= 3.1.0.

There is an unauthenticated SQL injection vulnerability in wpForo Forum versions up to 3.0.4.

The wpForo Forum plugin for WordPress has missing authorization, allowing exploitation of incorrectly configured access control security levels.

The wpForo Forum plugin for WordPress in versions up to and including 3.2.1 is vulnerable to SQL injection via the 'data' parameter due to insufficient escaping of user input and lack of proper preparation of the SQL query. An unauthenticated attacker can append additional SQL queries to extract sensitive information from the database, provided a searchable topic form field of type checkbox or a select/autocomplete field with isMultiChoice is registered in the forum configuration.

The wpForo Forum plugin for WordPress in versions up to and including 3.2.2 is vulnerable to Stored Cross-Site Scripting via the 'post[body]' parameter due to insufficient input sanitization and output escaping. Authenticated attackers with subscriber-level access or higher can inject arbitrary web scripts that execute when a user accesses an injected page.

The wpForo Forum plugin for WordPress in versions up to and including 3.2.2 is vulnerable to privilege escalation via the data[secondary_groupids] parameter in the wpforo_action_profile_update POST handler. A type-confusion flaw in the authorization guard within Members::update() allows an authenticated attacker with Subscriber-level access and above to escalate to wpForo Administrator by injecting the Admin group ID. Exploitation requires at least 3 approved posts and a valid nonce from the user's profile form.

The wpForo Forum plugin for WordPress in versions up to and including 3.2.2 is vulnerable to time-based SQL injection via the 'href[locale]' parameter due to insufficient escaping of user input and lack of proper preparation of the SQL query. An unauthenticated attacker can append additional SQL queries to extract sensitive information from the database; the required nonce is publicly issued on any forum page.

The wpForo Forum plugin for WordPress (up to version 3.2.2) is vulnerable to arbitrary file deletion due to insufficient file path validation in the theme_delete function. An authenticated attacker with Subscriber-level access can delete arbitrary files on the server, potentially leading to remote code execution. This requires an administrator to have created a custom group with a blank role and the 'mth' capability.

The wpForo Forum plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'telegram' profile field in versions up to and including 3.1.6. The raw $_POST['data'] array is copied into $custom_fields before validate() and sanitize() run, leaving it unsanitized when persisted.