What is the CVSS score of CVE-2026-49767?

CVE-2026-49767 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.5%.

Which versions of wpForo Forum are affected by CVE-2026-49767?

The wpForo Forum WordPress plugin (versions 3.1.0 and earlier) contains a critical unauthenticated authentication bypass (CVE-2026-49767, CVSS 9.8) allowing remote attackers to fully compromise…

How to fix or mitigate CVE-2026-49767?

Within 24 hours: inventory all wpForo installations and assess exposure scope; contact wpForo vendor to confirm patch timeline; prepare incident response procedures. Within 7 days: implement compensating controls-either disable/remove the plugin if non-critical, or deploy WAF rules and restrict access via network controls (IP whitelisting, VPN). Within 30 days: deploy vendor patch immediately upon release to all affected instances, or migrate to alternative forum software if patch remains unavailable.

wpForo Forum CVE-2026-49767

EUVD-2026-37623 CRITICAL

Authentication Bypass Using an Alternate Path or Channel (CWE-288)

2026-06-17 Patchstack

Information Disclosure Wpforo Forum

9.8

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

9.8 CRITICAL

Pre-auth broken authentication (CWE-288) in a network-exposed WordPress plugin justifies AV:N/AC:L/PR:N/UI:N; full auth bypass plausibly yields high CIA impact within the WordPress scope.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 17, 2026 - 12:02 vuln.today

DescriptionCVE.org

Unauthenticated Broken Authentication in wpForo Forum <= 3.1.0 versions.

AnalysisAI

Authentication bypass in the wpForo Forum WordPress plugin versions 3.1.0 and earlier allows remote unauthenticated attackers to compromise affected sites with high impact to confidentiality, integrity, and availability. The flaw is classified under CWE-288 (Authentication Bypass Using an Alternate Path or Channel) and carries a CVSS 9.8 rating, though no public exploit identified at time of analysis. The vulnerability is not currently listed in CISA KEV.

Technical ContextAI

wpForo Forum is a popular WordPress forum plugin developed by tomdever (gVectors Team) that adds discussion board functionality to WordPress sites, including user registration, profile management, and role-based access controls. The CWE-288 classification indicates the plugin exposes an alternate authentication path or channel that bypasses primary authentication checks - typically this manifests as an endpoint that fails to validate session state, nonce tokens, or capability checks before granting privileged actions. Per the CPE string cpe:2.3:a:tomdever:wpforo_forum, all versions up to and including 3.1.0 are in scope, and the Patchstack tag 'Information Disclosure' suggests the bypass exposes data normally restricted to authenticated users.

RemediationAI

Patch available per vendor advisory - upgrade wpForo Forum to a version newer than 3.1.0 as soon as the vendor publishes a fixed release, tracked via the Patchstack advisory at https://patchstack.com/database/wordpress/plugin/wpforo/vulnerability/wordpress-wpforo-forum-plugin-3-1-0-broken-authentication-vulnerability. Until the patched version is confirmed installed, administrators should deactivate the wpForo plugin entirely (which will disable forum functionality for end users) or place the WordPress site behind a WAF such as Wordfence or Patchstack with virtual patching enabled to block requests targeting the vulnerable endpoint. As an interim hardening step, restrict access to /wp-admin and any wpForo REST/AJAX endpoints by IP allow-list at the web server layer, accepting that this breaks anonymous forum browsing and registration; also audit existing user accounts and forum role assignments for unauthorized escalation that may have occurred prior to patching.