What is the CVSS score of CVE-2026-12697?

CVE-2026-12697 has a CVSS 3.1 base score of 5.4 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L. EPSS exploitation probability: 0.1%.

Is there a public PoC exploit available for CVE-2026-12697?

Yes, a public proof-of-concept exploit is available for CVE-2026-12697. Prioritise patching immediately. EPSS: 0.1%.

Is there a patch available for CVE-2026-12697?

Yes, a patch is available for CVE-2026-12697. Update the affected software to the latest version immediately.

wpForo Forum CVE-2026-12697

EUVD-2026-51437 MEDIUM

Authorization Bypass Through User-Controlled Key (CWE-639)

2026-07-31 WPScan

GHSA-x66g-mh39-q4gx

WordPress Authentication Bypass Wpforo Forum Unknown

5.4

CVSS 3.1 · Vendor: WPScan

Severity by source

Vendor (WPScan) PRIMARY

5.4 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L

vuln.today AI

5.4 MEDIUM

Subscriber authentication required (PR:L); network-reachable endpoint (AV:N); no confidentiality impact since attackers can only delete, not read, others' data.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (WPScan).

CVSS VectorVendor: WPScan

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

Low

Lifecycle Timeline

Analysis Generated

Jul 31, 2026 - 17:23 vuln.today

CVSS changed

Jul 31, 2026 - 17:22 NVD

5.4 (MEDIUM)

Patch available

Jul 31, 2026 - 07:01 EUVD

CVE Published

Jul 31, 2026 - 06:00 cve.org

UNKNOWN (no severity yet)

CVE Published

Jul 31, 2026 - 06:00 cve.org

MEDIUM 5.4

DescriptionCVE.org

The wpForo Forum WordPress plugin before 3.1.2 does not verify that an AI chat conversation belongs to the requesting user before deleting its messages, allowing users with a subscriber-level account to permanently delete the stored AI chat message history of any other user.

AnalysisAI

Insecure Direct Object Reference (IDOR) in the wpForo Forum WordPress plugin before 3.1.2 allows any subscriber-level authenticated user to permanently delete the AI chat message history of arbitrary other users by submitting deletion requests without ownership verification. The plugin's AI chat message deletion endpoint does not validate that the targeted conversation belongs to the requesting user, enabling low-privilege account holders to cause irreversible data loss across the platform. A publicly available proof-of-concept exists per WPScan reporting; however, EPSS is extremely low at 0.13% (3rd percentile) and the vulnerability has not been added to the CISA KEV catalog, indicating limited observed exploitation.

Technical ContextAI

The affected product is the wpForo Forum WordPress plugin (CPE: cpe:2.3:a:unknown:wpforo_forum:*:*:*:*:*:*:*:*) in all releases before 3.1.2. The root cause is CWE-639 - Authorization Bypass Through User-Controlled Key, commonly classified as an IDOR flaw. The plugin exposes an AI chat feature that stores per-user conversation histories server-side. When a delete request is issued, the plugin fails to verify that the conversation identifier supplied in the request corresponds to a conversation owned by the authenticated requester. Because the conversation or message identifier is user-controllable, a subscriber can substitute another user's identifier, causing the backend to process the deletion without any ownership check. This is a classic access-control failure at the object level, distinct from authentication failure - the user IS authenticated, but authorization over the specific resource is absent.

RemediationAI

Update the wpForo Forum WordPress plugin to version 3.1.2 or later immediately, as confirmed by the vendor advisory. The patch is available through the standard WordPress plugin repository and the WPScan report at https://wpscan.com/vulnerability/845362bb-a733-432e-86ac-7bf079d91e0f/. If immediate patching is not possible, the most effective compensating control is to disable the wpForo AI chat feature entirely within the plugin settings, which eliminates the vulnerable attack surface without affecting core forum functionality. Alternatively, restrict new user registrations to prevent untrusted subscribers from obtaining accounts, though this does not protect against already-registered subscribers. Role-level access controls at the WordPress level cannot substitute for the missing server-side object-ownership check. No known trade-offs exist for applying the patch.