Wpforo Forum CVE-2026-3666

Requires wpForo Forum plugin version 2.4.16 or earlier installed on WordPress. Attacker must be authenticated with at least subscriber-level access. Attacker embeds path traversal sequence in forum post, then deletes the post to trigger arbitrary file deletion on the server.

Real-world risk is substantial due to the combination of low attack complexity (AC:L), network accessibility (AV:N), and requiring only low-privilege authenticated access (PR:L). The CVSS 8.8 score accurately reflects severe potential impact across confidentiality, integrity, and availability (all rated High). Critically, subscriber-level access is the default lowest privilege tier for registered WordPress users, dramatically expanding the attack surface on community-driven sites. The vulnerability does not require user interaction (UI:N) and exploitation is straightforward once an attacker understands the path traversal injection point. However, mitigating factors include the requirement for authenticated access and the lack of confirmed active exploitation or CISA KEV listing. No public exploit code confirmed at time of analysis, though the technical details disclosed by Wordfence combined with the publicly visible code diff in the WordPress plugin repository provide sufficient information for skilled attackers to develop working exploits. Organizations using wpForo Forum with open user registration face immediate risk, while sites restricting account creation to trusted users have reduced exposure. The ability to delete arbitrary files including configuration files, database backups, or core WordPress files makes this a critical business risk for affected installations.

An attacker registers a subscriber account on a WordPress site running vulnerable wpForo Forum plugin version 2.4.16. They create a new forum post with content containing embedded path traversal sequences pointing to critical files, such as '../../../wp-config.php' or '../../../.htaccess'. The attacker then immediately deletes their own post, triggering the plugin's cleanup routine which attempts to delete referenced files without validating the path. This results in deletion of the wp-config.php file, rendering the WordPress site inoperable and potentially exposing database credentials if backup copies are accessible. Alternatively, targeting plugin files or theme components could disable security controls or enable further compromise. The attack requires no specialized tools beyond standard forum posting capabilities and succeeds with minimal technical complexity.