What is the CVSS score of CVE-2026-12698?

CVE-2026-12698 has a CVSS 3.1 base score of 4.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N. EPSS exploitation probability: 0.1%.

Is there a public PoC exploit available for CVE-2026-12698?

Yes, a public proof-of-concept exploit is available for CVE-2026-12698. Prioritise patching immediately. EPSS: 0.1%.

Is there a patch available for CVE-2026-12698?

Yes, a patch is available for CVE-2026-12698. Update the affected software to the latest version immediately.

wpForo Forum CVE-2026-12698

EUVD-2026-52583 MEDIUM

Improper Access Control (CWE-284)

2026-08-04 WPScan

GHSA-898j-cg5m-8wj7

WordPress Authentication Bypass Wpforo Forum Unknown

4.3

CVSS 3.1 · Vendor: WPScan

Severity by source

Vendor (WPScan) PRIMARY

4.3 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

vuln.today AI

4.3 MEDIUM

Subscriber authentication required (PR:L); impact limited to own profile field integrity (I:L); no confidentiality, availability, or scope-change applies.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (WPScan).

CVSS VectorVendor: WPScan

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Aug 04, 2026 - 15:33 vuln.today

Patch available

Aug 04, 2026 - 07:01 EUVD

CVE Published

Aug 04, 2026 - 06:00 cve.org

MEDIUM 4.3

CVE Published

Aug 04, 2026 - 06:00 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

The wpForo Forum WordPress plugin before 3.1.3 does not restrict which profile fields a member may set when editing their own account, allowing users with a subscriber-level account to write administrator-controlled account-state and reputation fields on their own profile, including self-activating a pending or banned account and forging their forum reputation score.

AnalysisAI

Improper access control in the wpForo Forum WordPress plugin before 3.1.3 permits any subscriber-level authenticated user to write to administrator-controlled profile fields - including account activation status and forum reputation score - during a standard self-service profile update. This allows a banned or pending user to self-activate their own account, bypassing moderator enforcement, and to forge an arbitrarily high reputation score that may unlock elevated forum privileges. No CISA KEV listing exists, but a publicly available exploit is documented by WPScan; the EPSS score of 0.14% (4th percentile) indicates low observed exploitation probability at scale, though the low barrier to attack (any registered user) makes it a meaningful integrity risk for moderated forums.

Technical ContextAI

wpForo Forum is a WordPress plugin providing community forum functionality with a role-differentiated profile system: administrators govern sensitive account-state fields (activation status, ban state, reputation) while subscribers may only edit basic personal fields. The vulnerability is rooted in CWE-284 (Improper Access Control) - specifically, the profile-update request handler does not enforce field-level authorization before persisting subscriber-supplied POST data. This means any field accepted by the server-side profile model - including privileged fields never intended for subscriber write access - can be set by crafting a POST request with arbitrary parameters. The CPE string cpe:2.3:a:unknown:wpforo_forum:*:*:*:*:*:*:*:* covers all releases prior to 3.1.3. The CVSS vector AV:N/AC:L/PR:L confirms the attack is network-reachable, requires no special conditions, and only a subscriber credential.

RemediationAI

The primary fix is to upgrade wpForo Forum to version 3.1.3 or later, which introduces field-level authorization checks on the profile update endpoint; the patched release is confirmed by the WPScan advisory at https://wpscan.com/vulnerability/b90a74b5-1694-4afc-9232-95cf092e2c98/. If immediate upgrade is not feasible, administrators should disable open user registration to prevent untrusted parties from obtaining the subscriber-level credential required for exploitation - note this prevents new community members from joining. As an additional compensating control, moderators should audit existing subscriber accounts for anomalous account-state values (e.g., reactivated banned accounts) or suspiciously high reputation scores by querying the wpForo user meta tables directly in the database. Implementing a WAF rule to strip unexpected profile-field parameters from POST requests to the profile update endpoint is technically possible but risks breaking legitimate profile editing for all users and is therefore a high-friction option with uncertain coverage. No workaround fully replaces the patch.