Skip to main content

wpForo Forum EUVDEUVD-2026-51437

| CVE-2026-12697 MEDIUM
Authorization Bypass Through User-Controlled Key (CWE-639)
2026-07-31 WPScan GHSA-x66g-mh39-q4gx
WordPress Authentication Bypass Wpforo Forum
5.4
CVSS 3.1 · Vendor: WPScan
Share

Severity by source

Vendor (WPScan) PRIMARY
5.4 MEDIUM
AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L
vuln.today AI
5.4 MEDIUM

Subscriber authentication required (PR:L); network-reachable endpoint (AV:N); no confidentiality impact since attackers can only delete, not read, others' data.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L
4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (WPScan).

CVSS VectorVendor: WPScan

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L
Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
Low
Availability
Low

Lifecycle Timeline

5
Analysis Generated
Jul 31, 2026 - 17:23 vuln.today
CVSS changed
Jul 31, 2026 - 17:22 NVD
5.4 (MEDIUM)
Patch available
Jul 31, 2026 - 07:01 EUVD
CVE Published
Jul 31, 2026 - 06:00 cve.org
UNKNOWN (no severity yet)
CVE Published
Jul 31, 2026 - 06:00 cve.org
MEDIUM 5.4

DescriptionCVE.org

The wpForo Forum WordPress plugin before 3.1.2 does not verify that an AI chat conversation belongs to the requesting user before deleting its messages, allowing users with a subscriber-level account to permanently delete the stored AI chat message history of any other user.

AnalysisAI

Insecure Direct Object Reference (IDOR) in the wpForo Forum WordPress plugin before 3.1.2 allows any subscriber-level authenticated user to permanently delete the AI chat message history of arbitrary other users by submitting deletion requests without ownership verification. The plugin's AI chat message deletion endpoint does not validate that the targeted conversation belongs to the requesting user, enabling low-privilege account holders to cause irreversible data loss across the platform. …

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts
Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access
Register subscriber account on target site
Delivery
Identify wpForo AI chat conversation IDs via enumeration or POC tooling
Exploit
Craft delete request substituting victim's conversation ID
Execution
Submit request authenticated as subscriber
Impact
Victim's AI chat history permanently deleted
Sign in to reveal

Vulnerability AssessmentAI

Exploitation Exploitation requires a valid subscriber-level account on the target WordPress site (PR:L per CVSS), meaning the attacker must be registered and logged in - unauthenticated exploitation is not possible. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment The NVD CVSS 3.1 score of 5.4 (Medium) with vector AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L accurately reflects the attack surface: network-reachable, low complexity, but gated by the need for a subscriber-level account, and limited to integrity and availability impacts with no confidentiality exposure. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario An attacker registers a free subscriber-level account on a WordPress site running wpForo Forum with AI chat enabled. Using the publicly available proof-of-concept, the attacker iterates through conversation or message identifiers belonging to other users and submits deletion requests, permanently erasing their AI chat histories. …
Remediation Update the wpForo Forum WordPress plugin to version 3.1.2 or later immediately, as confirmed by the vendor advisory. … Detailed patch versions, workarounds, and compensating controls in full report.
Sign in to read full assessment

Threat intelligence, references, and detailed analysis are available after sign-in.

More in Wpforo Forum

View all
CVE-2023-2249 HIGH
8.8 Jun 09

The wpForo Forum plugin for WordPress is vulnerable to Local File Include, Server-Side Request Forgery, and PHAR Deseria
CVE-2024-3200 CRITICAL
9.9 Jun 01

The wpForo Forum plugin for WordPress is vulnerable to SQL Injection via the 'slug' attribute of the 'wpforo' shortcode

CVE-2023-2309 MEDIUM POC
6.1 Jul 24

The wpForo Forum WordPress plugin before 2.1.9 does not escape some request parameters while in debug mode, leading to a
CVE-2021-24406 MEDIUM POC
6.1 Jul 06

The wpForo Forum WordPress plugin before 1.9.7 did not validate the redirect_to parameter in the login form of the forum
CVE-2018-11709 MEDIUM POC
6.1 Jun 04

wpforo_get_request_uri in wpf-includes/functions.php in the wpForo Forum plugin before 1.4.12 for WordPress allows Unaut
CVE-2026-49769 CRITICAL
9.8 Jun 15

Unauthenticated PHP Object Injection in the wpForo Forum WordPress plugin versions 3.1.0 and earlier allows remote attac
CVE-2026-49767 CRITICAL
9.8 Jun 17

Authentication bypass in the wpForo Forum WordPress plugin versions 3.1.0 and earlier allows remote unauthenticated atta
CVE-2026-12696 MEDIUM POC
5.4 Aug 01

Stored cross-site scripting in wpForo Forum WordPress plugin before 3.1.2 allows a subscriber-level authenticated user t
CVE-2026-40798 CRITICAL
9.3 Jun 15

Unauthenticated SQL injection in the wpForo Forum WordPress plugin (versions 3.0.4 and earlier) allows remote attackers

CVE-2026-3666 HIGH
8.8 Apr 04

Arbitrary file deletion in wpForo Forum WordPress plugin versions ≤2.4.16 allows authenticated attackers with subscriber
CVE-2022-40200 HIGH
8.8 Nov 17

Auth. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch
CVE-2022-40192 HIGH
8.8 Nov 17

Cross-Site Request Forgery (CSRF) vulnerability in wpForo Forum plugin <= 2.0.9 on WordPress. Rated high severity (CVSS

Same weakness CWE-639 – Authorization Bypass Through User-Controlled Key

View all
CVE-2024-50483 CRITICAL
9.8
CVE-2026-55255 HIGH POC
8.4
CVE-2025-3605 CRITICAL POC
9.8
CVE-2022-3805 HIGH POC
8.6
CVE-2025-5947 CRITICAL POC
9.8
CVE-2020-36923 CRITICAL POC
9.8
CVE-2023-3048 CRITICAL POC
9.8
CVE-2024-27730 CRITICAL POC
9.8

Same technique Authentication Bypass

View all
CVE-2023-22515 CRITICAL POC
9.8
CVE-2012-4681 CRITICAL POC
9.8
CVE-2013-2465 CRITICAL POC
9.8
CVE-2011-3544 CRITICAL POC
9.8
CVE-2022-40684 CRITICAL POC
9.8
CVE-2025-61882 CRITICAL POC
9.8
CVE-2024-0012 CRITICAL POC
9.3
CVE-2023-46805 HIGH POC
8.2

Share

EUVD-2026-51437 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy