EUVD-2026-84304
GHSA-439g-qg26-vjww
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Authenticated subscriber (PR:L) over the network (AV:N) alters another user's post data (I:L) with no disclosure or availability loss; AC:L kept per vendor though the guest-config plus known-email preconditions could justify AC:H.
Primary rating from Vendor (Wordfence).
CVSS VectorVendor: Wordfence
Lifecycle Timeline
3DescriptionCVE.org
The wpForo Forum plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 3.1.5. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with subscriber-level access and above, to take over another guest author's forum post and modify its title, body, author name, and stored owner email address. This requires that guest posting and editing are enabled on the forum, and that the attacker knows the target guest author's email address.
AnalysisAI
Authorization bypass in the wpForo Forum plugin for WordPress (all versions up to and including 3.1.5) lets an authenticated attacker with subscriber-level access or higher take over another guest author's forum post and rewrite its title, body, author name, and stored owner email address. Exploitation is conditional rather than automatic: the forum must be configured with BOTH guest posting AND guest editing enabled (a non-default deployment choice), and the attacker must already know the specific target guest author's email address, which functions as the record selector. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
No credit card · 7-day full trial
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires all of the following: (1) an authenticated account with subscriber-level access or above on the target site; (2) the wpForo forum configured to allow BOTH guest posting AND guest editing (a non-default deployment choice); and (3) prior knowledge of the specific target guest author's email address, which acts as the record selector. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a low-severity authorization flaw (vendor CVSS 4.3, CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) whose real-world priority is minor. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upstream fix available (changeset/commit); released patched version not independently confirmed - the reference https://plugins.trac.wordpress.org/changeset?reponame=&old=3702319%40wpforo&new=3702319%40wpforo indicates the corrective change, but no tagged patched version is confirmed in the supplied data, so verify the currently published wpForo release on wordpress.org and upgrade past the 3.1.5 source, then confirm the diff against the cited files (classes/Posts.php, classes/Members.php, classes/Actions.php, includes/hooks.php, includes/functions.php) before considering the site fixed. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 in certain configurations of FPM setup it
sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not
(1) boardData102.php, (2) boardData103.php, (3) boardDataJP.php, (4) boardDataNA.php, and (5) boardDataWW.php in Netgear
The '/common/download_agent_installer.php' script in the Quest KACE System Management Appliance 8.0.318 is accessible by
ProjectSend versions prior to r1720 are affected by an improper authentication vulnerability. Rated critical severity (C
Roundcube Webmail contains a critical PHP object deserialization vulnerability (CVE-2025-49113, CVSS 9.9) that allows au
Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP c
Palo Alto Networks PAN-OS management web interface contains an authentication bypass allowing unauthenticated attackers
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
The get_referers function in /opt/ws/bin/sblistpack in Sophos Web Appliance before 3.7.9.1 and 3.8 before 3.8.1.1 allows
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
Same weakness CWE-862 – Missing Authorization
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today