What is the CVSS score of CVE-2026-5809?

CVE-2026-5809 has a CVSS 3.1 base score of 7.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:H. EPSS exploitation probability: 0.0%.

Which versions of PHP are affected by CVE-2026-5809?

CVE-2026-5809 affects wpForo Forum plugin versions 3.0.2 and earlier, allowing any subscriber-level user to delete critical WordPress files including wp-config.php, causing complete site…

How to fix or mitigate CVE-2026-5809?

Within 24 hours: Disable wpForo Forum plugin or restrict file deletion permissions at the WordPress level; audit user accounts with subscriber+ roles for suspicious activity. Within 7 days: Contact wpForo developers for patch timeline; prepare upgrade plan to version >3.0.2 when available. Within 30 days: Apply vendor patch immediately upon release; implement principle-of-least-privilege access controls limiting subscriber capabilities; deploy Web Application Firewall rules blocking postmeta manipulation patterns.

PHP CVE-2026-5809

EUVD-2026-21676 HIGH

External Control of File Name or Path (CWE-73)

2026-04-11 Wordfence

WordPress PHP Information Disclosure

7.1

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.1 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

High

Lifecycle Timeline

Re-analysis Queued

Apr 24, 2026 - 18:07 vuln.today

cvss_changed

EUVD ID Assigned

Apr 11, 2026 - 08:15 euvd

EUVD-2026-21676

Analysis Generated

Apr 11, 2026 - 08:15 vuln.today

CVE Published

Apr 11, 2026 - 07:40 nvd

HIGH 7.1

DescriptionCVE.org

The wpForo Forum plugin for WordPress is vulnerable to Arbitrary File Deletion in versions up to and including 3.0.2. This is due to a two-step logic flaw: the topic_add() and topic_edit() action handlers accept arbitrary user-supplied data[*] arrays from $_REQUEST and store them as postmeta without restricting which fields may contain array values. Because 'body' is included in the allowed topic fields list, an attacker can supply data[body][fileurl] with an arbitrary file path (e.g., wp-config.php or an absolute server path). This poisoned fileurl is persisted to the plugin's custom postmeta database table. Subsequently, when the attacker submits wpftcf_delete[]=body on a topic_edit request, the add_file() method retrieves the stored postmeta record, extracts the attacker-controlled fileurl, passes it through wpforo_fix_upload_dir() which only rewrites legitimate wpforo upload paths and returns all other paths unchanged, and then calls wp_delete_file() on the unvalidated path. This makes it possible for authenticated attackers, with subscriber-level access and above, to delete arbitrary files writable by the PHP process on the server, including critical files such as wp-config.

AnalysisAI

Arbitrary file deletion in wpForo Forum plugin for WordPress (≤3.0.2) allows authenticated attackers with subscriber-level access to delete critical server files including wp-config.php. A two-step logic flaw permits injection of attacker-controlled file paths via poisoned postmeta arrays (data[body][fileurl]), which are later passed unvalidated to wp_delete_file(). The vulnerability requires low-privilege authentication (PR:L) and enables denial-of-service against WordPress installations through deletion of configuration or core files. No public exploit identified at time of analysis.

Technical ContextAI

Root cause combines CWE-73 (external control of file path) with insecure deserialization of $_REQUEST arrays. The topic_add/topic_edit handlers fail to sanitize nested array values before persisting to custom postmeta tables. The wpforo_fix_upload_dir() path rewrite function only normalizes legitimate upload paths, returning attacker-controlled absolute paths unchanged before file deletion operations.

RemediationAI

Upstream fix available via changeset 3503313 committed to WordPress plugin repository; released patched version not independently confirmed. Administrators should immediately update wpForo Forum to the latest available version from the WordPress plugin repository (https://plugins.trac.wordpress.org/changeset/3503313/wpforo). Until patch deployment, disable subscriber-level user registration or deactivate the wpForo Forum plugin entirely to eliminate attack surface. Restrict PHP process file permissions to prevent deletion of critical system files as a defense-in-depth measure. Verify integrity of wp-config.php and core WordPress files post-remediation. Full technical analysis available at https://www.wordfence.com/threat-intel/vulnerabilities/id/0e46ac8d-89ee-4480-bb96-83f2044a4323?source=cve. Monitor server logs for suspicious topic_edit POST requests containing wpftcf_delete parameters or nested data[body][fileurl] arrays.