What is the CVSS score of CVE-2026-4666?

CVE-2026-4666 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N. EPSS exploitation probability: 0.0%.

PHP CVE-2026-4666

EUVD-2026-23347 MEDIUM

Missing Authorization (CWE-862)

2026-04-17 Wordfence

GHSA-gq2v-mwv7-cvm2

PHP Authentication Bypass WordPress

6.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

Apr 17, 2026 - 03:33 vuln.today

EUVD ID Assigned

Apr 17, 2026 - 03:30 euvd

EUVD-2026-23347

Analysis Generated

Apr 17, 2026 - 03:30 vuln.today

CVE Published

Apr 17, 2026 - 02:25 nvd

MEDIUM 6.5

DescriptionCVE.org

The wpForo Forum plugin for WordPress is vulnerable to unauthorized modification of data due to the use of extract($args, EXTR_OVERWRITE) on user-controlled input in the edit() method of classes/Posts.php in all versions up to, and including, 2.4.16. The post_edit action handler in Actions.php passes $_REQUEST['post'] directly to Posts::edit(), which calls extract($args, EXTR_OVERWRITE). An attacker can inject post[guestposting]=1 to overwrite the local $guestposting variable, causing the entire permission check block to be skipped. The nonce check uses a hardcoded wpforo_verify_form action shared across all 8 forum templates, so any user who can view any forum page obtains a valid nonce. This makes it possible for authenticated attackers, with Subscriber-level access and above, to edit the title, body, name, and email fields of any forum post, including posts in private forums, admin posts, and moderator posts. Content passes through wpforo_kses() which strips JavaScript but allows rich HTML.

AnalysisAI

wpForo Forum plugin for WordPress allows authenticated Subscriber-level attackers to modify arbitrary forum posts via variable extraction abuse and weak nonce validation. Attackers exploit the extract($args, EXTR_OVERWRITE) function in the edit() method to bypass permission checks, enabling unauthorized modification of post titles, bodies, names, and emails across all forum visibility levels including private forums and admin/moderator posts. A hardcoded nonce shared across all forum templates allows any user viewing any forum page to obtain a valid nonce, making exploitation trivial for authenticated users.

Technical ContextAI

The vulnerability stems from unsafe use of PHP's extract() function with the EXTR_OVERWRITE flag, which converts array keys into variable names and overwrites existing variables. When user-controlled $_REQUEST['post'] data flows directly from the post_edit action handler in Actions.php (line 773) to Posts::edit() in classes/Posts.php (lines 283-285), an attacker can inject a guestposting parameter that overwrites the local variable used in permission validation logic. The nonce validation in includes/functions.php (line 532) uses a single hardcoded wpforo_verify_form action name across all eight forum templates, meaning a nonce captured from viewing any forum page remains valid for modifying any post. This violates the principle of least privilege for both variable scope and CSRF token specificity. The wpforo_kses() output filter strips JavaScript but permits HTML, allowing attribute injection while preventing direct script execution.

RemediationAI

Update wpForo Forum to version 2.4.17 or later immediately. The vendor has released a patched version available at https://ti.wordfence.io/vendors/patch/1885/download and confirmed via the plugin repository changelog (https://plugins.trac.wordpress.org/changeset?old_path=%2Fwpforo/tags/2.4.16&new_path=%2Fwpforo/tags/2.4.17). If immediate update is impossible, enforce additional access controls by restricting the post_edit action to Editor and Administrator roles only through a WordPress must-use plugin or site-hardening mechanism; however, this prevents legitimate Subscribers from editing their own posts and is not a complete fix. Alternatively, implement a Web Application Firewall rule to block POST requests containing post[guestposting] parameters, though this may fail if the variable name changes in workarounds. The complete fix requires patching to eliminate the unsafe extract() usage and implement post-type and role-specific nonce validation.