What is the CVSS score of CVE-2026-3666?

CVE-2026-3666 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of WordPress are affected by CVE-2026-3666?

wpForo Forum plugin versions 2.4.16 and earlier contain an arbitrary file deletion vulnerability that allows any authenticated subscriber to delete critical server files through malicious forum…

How to fix or mitigate CVE-2026-3666?

Within 24 hours: Audit all WordPress instances for wpForo plugin installation and identify current versions via wp-cli or admin dashboard. Within 7 days: Upgrade wpForo to version 2.4.17 or later on all affected sites; if upgrade blocked by compatibility issues, disable the plugin and document business justification. Within 30 days: Review file system permissions to implement principle of least privilege for web server process, and conduct file integrity monitoring audit of critical system files.

WordPress CVE-2026-3666

EUVD-2026-18999 HIGH

Path Traversal (CWE-22)

2026-04-04 Wordfence

WordPress Path Traversal

8.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.8 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Re-analysis Queued

Apr 24, 2026 - 18:22 vuln.today

cvss_changed

EUVD ID Assigned

Apr 04, 2026 - 11:30 euvd

EUVD-2026-18999

Analysis Generated

Apr 04, 2026 - 11:30 vuln.today

CVE Published

Apr 04, 2026 - 11:16 nvd

HIGH 8.8

DescriptionCVE.org

The wpForo Forum plugin for WordPress is vulnerable to arbitrary file deletion in all versions up to, and including, 2.4.16. This is due to a missing file name/path validation against path traversal sequences. This makes it possible for authenticated attackers, with subscriber level access and above, to delete arbitrary files on the server by embedding a crafted path traversal string in a forum post body and then deleting the post.

AnalysisAI

Arbitrary file deletion in wpForo Forum WordPress plugin versions ≤2.4.16 allows authenticated attackers with subscriber-level privileges to delete any file on the server by embedding path traversal sequences in forum post content and subsequently deleting the post. CVSS 8.8 (High) with network-based attack vector requiring low-complexity exploitation. No public exploit identified at time of analysis, though EPSS data unavailable. Patched in version 2.4.17 per WordPress plugin repository changeset.

Technical ContextAI

This vulnerability stems from insufficient input validation in the wpForo Forum plugin's file handling logic (CWE-22: Improper Limitation of a Pathname to a Restricted Directory). The Posts.php class fails to sanitize file paths before processing deletion operations, allowing path traversal sequences like '../../../' to escape intended directories. When an authenticated user creates a forum post containing malicious file path references and then deletes that post, the plugin's cleanup routine processes the traversal sequence literally, enabling deletion of arbitrary files anywhere the web server process has write permissions. The affected component (cpe:2.3:a:tomdever:wpforo_forum) is a community forum solution for WordPress that manages user-generated content and associated file operations. The vulnerability exists in the post deletion workflow where attachment or reference cleanup occurs without validating that target paths remain within the plugin's designated upload directory.

RemediationAI

Immediately upgrade wpForo Forum plugin to version 2.4.17 or later, which addresses the path traversal vulnerability through proper file path validation. The fix is documented in the WordPress plugin repository changeset at https://plugins.trac.wordpress.org/changeset?old_path=wpforo/tags/2.4.16/classes/Posts.php&new_path=wpforo/tags/2.4.17/classes/Posts.php&old=3471614&new=3483044, showing modifications to the Posts.php class that implement sanitization of file paths before deletion operations. Site administrators should update through the WordPress admin dashboard (Plugins > Update Available) or manually download version 2.4.17 from the official WordPress plugin repository. As an interim workaround if immediate patching is not feasible, restrict new user registrations and review existing subscriber-level accounts for legitimacy, though this only reduces attack surface and does not eliminate the vulnerability. After patching, audit server file system integrity and review web server logs for suspicious post creation/deletion patterns that may indicate exploitation attempts. Conduct a security review of file permissions to ensure the web server process operates with minimum necessary privileges to limit potential damage from similar vulnerabilities.