EUVD-2026-95731
GHSA-gc8x-g7gp-6x8w
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate as low-privilege forum user
-
ExploitSend request to unprotected forum endpoint
-
ExecutionMissing authorization check bypassed
-
ImpactDisclose restricted forum data
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Authorization checks on every request
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires an authenticated account on the target WordPress site (PR:L in the CVSS vector) - typically any registered forum member - because the flaw is a missing authorization check on an Asgaros Forum function rather than an unauthenticated endpoint. No user interaction is needed (UI:N) and the request is sent over the network (AV:N), but the authentication requirement is the key limiting factor: sites that do not permit untrusted user registration sharply reduce exposure. Impact is confined to limited information disclosure (C:L, no integrity or availability effect), and the affected code path is in Asgaros Forum versions through 3.4.0, so sites on a later fixed release are not exposed. |
| Impact | This is a moderate, low-priority issue rather than an urgent one. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N, base 4.3) describes a network-reachable, low-complexity flaw that nonetheless REQUIRES existing low-level privileges (PR:L) - i.e. an authenticated account - and yields only limited confidentiality impact (C:L) with no integrity or availability effect. This is a CWE-862 Missing Authorization / broken access control flaw, meaning an authenticated low-privilege user can reach a function or data they should not, not an unauthenticated takeover. No EPSS score, SSVC decision, KEV listing, or POC was supplied in the input, so there is no public exploit identified at time of analysis and no evidence of active exploitation. The signals are internally consistent (low severity, authenticated access, information-only impact), so there is no CVSS-vs-reality conflict to flag; the main caveat is that exploitation probability cannot be quantified because EPSS data is absent. Overall: a real but low-urgency bug best handled through normal plugin patching, not emergency response. |
| Exploit ScenarioDerived | An attacker who already holds a low-privilege authenticated account on a WordPress site running Asgaros Forum (≤ 3.4.0) - for example a self-registered forum member - sends a crafted request to a forum endpoint that fails to verify authorization, causing it to disclose data the account should not be able to view. No public exploit code was identified in the input, and the limited confidentiality-only impact (C:L) means the outcome is information exposure rather than site compromise. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 09, 2026
Missing authorization in the Asgaros Forum WordPress plugin (versions through 3.4.0) lets a logged-in low-privilege account reach a forum function that should be gated by a capability check, resulting in limited information disclosure. The CVSS vector (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N, score 4.3) confirms that an attacker must already hold an account on the target site - typically any registered forum member - because the flaw is a missing authorization check rather than an unauthenticated entry point, and the impact is confined to confidentiality with no integrity or availability effect. There is no CISA KEV listing and no public exploit code identified at time of analysis, so this is a moderate, low-priority issue; sites that do not allow untrusted user registration sharply reduce their exposure.
RemediationAI
No vendor-released patch is identified in the available data, so the first step is to check the Patchstack advisory (https://patchstack.com/database/wordpress/plugin/asgaros-forum/vulnerability/wordpress-asgaros-forum-plugin-3-4-0-broken-access-control-vulnerability?_s_id=cve) and the Asgaros Forum release notes for a fixed build above 3.4.0, then upgrade as soon as one is confirmed - since the affected range ends at 3.4.0, any later release is the natural upgrade target, but the exact fixed version is not stated in the input. Until a patch is verified, apply targeted compensating controls: disable open WordPress user registration and require administrator approval for new accounts (this removes the low-privilege foothold the exploit depends on, at the cost of increased sign-up friction), and restrict forum membership to trusted roles so untrusted visitors cannot obtain the PR:L account needed. If a virtual patching layer or WAF is in place, block or challenge requests that invoke the plugin's forum action endpoints from non-privileged roles, accepting that broad rule sets can cause false positives for legitimate members. Audit the forum's WordPress role and capability assignments to confirm no low-privilege role inherits elevated Asgaros capabilities, and monitor plugin access logs for authenticated users enumerating content they should not see. Removing or disabling the Asgaros Forum plugin entirely is the only complete mitigation if the forum is not required, and eliminates the exposure without depending on a vendor fix.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability is classified as CWE-862 (Missing Authorization) in the Asgaros Forum plugin for WordPress, a self-hosted forum/bulletin-board component that adds its own roles, capabilities, and AJAX/REST handlers on top of WordPress's standard capability system. The root cause class is a failure to enforce a capability or nonce/permission check on a forum code path, meaning the application trusts the caller's authentication state without verifying that the caller's role is actually authorized for the action - the pattern Patchstack describes as broken access control or 'exploiting incorrectly configured access control security levels.' The CPE cpe:2.3:a:asgaros:asgaros_forum:*:*:*:*:*:*:*:* indicates the entire plugin line up to and including 3.4.0 is in scope, deployed as a plugin inside a WordPress installation. Although the source tags include 'Authentication Bypass,' the authoritative assessed vector carries PR:L, so the defect is more accurately characterized as a privilege/authorization-check gap reachable by an already-authenticated user rather than a true pre-authentication bypass. Because the request is network-delivered (AV:N) and requires no user interaction (UI:N), exploitation is technically simple once valid low-privilege credentials exist.
Know when Asgaros Forum gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Missing authorization reachable over the network by any authenticated low-privilege forum user (PR:L), low complexity, no UI, yielding limited confidentiality disclosure only (C:L, I:N, A:N).
Primary rating from Vendor (Patchstack).
CVSS VectorVendor: Patchstack
DescriptionCVE.org
Missing Authorization vulnerability in Asgaros Asgaros Forum asgaros-forum allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Asgaros Forum: from n/a through 3.4.0.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
More in Asgaros Forum
View allThe Asgaros Forum WordPress plugin before 2.7.1 allows forum administrators, who may not be WordPress (super-)administra
The Asgaros Forum WordPress plugin before 1.15.13 does not validate and escape user input when subscribing to a topic be
The Asgaros Forum WordPress plugin before 2.0.0 does not sanitise and escape the post_id parameter before using it in a
Deserialization of Untrusted Data vulnerability in Thomas Belser Asgaros Forum.7.2. Rated high severity (CVSS 8.7), this
The Asgaros Forums WordPress plugin is vulnerable to Stored Cross-Site Scripting due to insufficient escaping via the na
Cross-Site Request Forgery (CSRF) vulnerability in Thomas Belser Asgaros Forum.8.0. Rated medium severity (CVSS 4.3), th
Exploit-DB