What is the CVSS score of CVE-2026-49769?

CVE-2026-49769 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.4%.

Which versions of wpForo Forum are affected by CVE-2026-49769?

The wpForo Forum plugin for WordPress (versions 3.1.0 and earlier) contains a critical unauthenticated remote code execution vulnerability (CVSS 9.8) affecting any organization running this plugin.

How to fix or mitigate CVE-2026-49769?

Within 24 hours: Identify all WordPress installations running wpForo 3.1.0 or earlier; immediately disable the plugin if an alternative exists. Within 7 days: Deploy Web Application Firewall rules to block suspicious PHP serialization attempts; increase logging and monitoring on all forum requests; restrict access to affected servers. Within 30 days: Request patch timeline from wpForo vendor; migrate to an actively maintained alternative forum platform; implement plugin security review and approval process.

wpForo Forum CVE-2026-49769

EUVD-2026-36892 CRITICAL

Deserialization of Untrusted Data (CWE-502)

2026-06-15 Patchstack

GHSA-pm7h-3vhv-6q5v

PHP Deserialization Wpforo Forum

9.8

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

9.8 CRITICAL

Unauthenticated network-reachable PHP deserialization in a WordPress plugin typically yields RCE via POP chains, justifying AV:N/AC:L/PR:N/UI:N and high CIA impact.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 15, 2026 - 21:29 vuln.today

DescriptionCVE.org

Unauthenticated PHP Object Injection in wpForo Forum <= 3.1.0 versions.

AnalysisAI

Unauthenticated PHP Object Injection in the wpForo Forum WordPress plugin versions 3.1.0 and earlier allows remote attackers to deliver untrusted serialized payloads that are deserialized by the plugin, leading to potential remote code execution, data tampering, and full site compromise depending on available POP gadget chains. The flaw is reachable without authentication over the network and carries a vendor CVSS of 9.8; no public exploit identified at time of analysis and the issue is not currently on the CISA KEV list.

Technical ContextAI

wpForo Forum is a popular WordPress forum plugin maintained by tomdever (CPE cpe:2.3:a:tomdever:wpforo_forum). The root cause class is CWE-502 (Deserialization of Untrusted Data): the plugin calls PHP's unserialize() (or equivalent) on attacker-controlled input without integrity validation. In PHP, unserialize() instantiates objects and invokes magic methods such as __wakeup, __destruct, and __toString, which can be chained through 'POP gadgets' present in WordPress core, other active plugins, or Composer dependencies to achieve arbitrary file write, SQL injection, or remote code execution. Because WordPress sites typically load many plugins simultaneously, the gadget surface is broad and exploitation primitives are commonly available.

RemediationAI

Patch available per vendor advisory - upgrade wpForo Forum to a version higher than 3.1.0 as published on the WordPress.org plugin repository and tracked in the Patchstack advisory at https://patchstack.com/database/wordpress/plugin/wpforo/vulnerability/wordpress-wpforo-forum-plugin-3-1-0-php-object-injection-vulnerability; the input data does not specify the exact fixed release number, so administrators should consult that advisory for the confirmed patched version. If an immediate upgrade is not possible, deactivate the wpForo plugin until it can be updated (trade-off: forum becomes unavailable to users), or place a WAF rule in front of the site that blocks request bodies and query parameters containing PHP serialized object markers such as 'O:' and 'a:' targeting wpForo endpoints (trade-off: may produce false positives on legitimate forum content containing those substrings). Audit logs for suspicious POST traffic to wpForo URLs and rotate any secrets that could have been exfiltrated.