EUVD-2026-52583
GHSA-898j-cg5m-8wj7
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Subscriber authentication required (PR:L); impact limited to own profile field integrity (I:L); no confidentiality, availability, or scope-change applies.
Primary rating from Vendor (WPScan).
CVSS VectorVendor: WPScan
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Lifecycle Timeline
4DescriptionCVE.org
The wpForo Forum WordPress plugin before 3.1.3 does not restrict which profile fields a member may set when editing their own account, allowing users with a subscriber-level account to write administrator-controlled account-state and reputation fields on their own profile, including self-activating a pending or banned account and forging their forum reputation score.
AnalysisAI
Improper access control in the wpForo Forum WordPress plugin before 3.1.3 permits any subscriber-level authenticated user to write to administrator-controlled profile fields - including account activation status and forum reputation score - during a standard self-service profile update. This allows a banned or pending user to self-activate their own account, bypassing moderator enforcement, and to forge an arbitrarily high reputation score that may unlock elevated forum privileges. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The attacker must possess a valid subscriber-level WordPress account on the target site running wpForo Forum before 3.1.3 - obtained either by self-registering if open registration is enabled, or by reusing previously valid credentials. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The NVD-assigned CVSS 3.1 score of 4.3 (Medium) is consistent with the actual impact profile: the attack is network-accessible (AV:N), trivially simple (AC:L), requires low privileges (PR:L - any registered subscriber), needs no user interaction (UI:N), does not change scope (S:U), and yields only a low integrity impact (I:L) with no confidentiality or availability consequences. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | A user whose forum account was banned by a moderator logs back in (if WordPress session persistence allows) or registers a new account via open registration, then submits a crafted HTTP POST request to the wpForo profile update endpoint with the `account_status` field set to `active` and a `reputation` value of their choosing. The plugin processes the submission without validating that these fields are restricted to administrator writes, immediately reactivating the banned account and crediting the attacker with a forged reputation score. … |
| Remediation | The primary fix is to upgrade wpForo Forum to version 3.1.3 or later, which introduces field-level authorization checks on the profile update endpoint; the patched release is confirmed by the WPScan advisory at https://wpscan.com/vulnerability/b90a74b5-1694-4afc-9232-95cf092e2c98/. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Wpforo Forum
View allThe wpForo Forum plugin for WordPress is vulnerable to Local File Include, Server-Side Request Forgery, and PHAR Deseria
The wpForo Forum plugin for WordPress is vulnerable to SQL Injection via the 'slug' attribute of the 'wpforo' shortcode
The wpForo Forum WordPress plugin before 2.1.9 does not escape some request parameters while in debug mode, leading to a
The wpForo Forum WordPress plugin before 1.9.7 did not validate the redirect_to parameter in the login form of the forum
wpforo_get_request_uri in wpf-includes/functions.php in the wpForo Forum plugin before 1.4.12 for WordPress allows Unaut
Unauthenticated PHP Object Injection in the wpForo Forum WordPress plugin versions 3.1.0 and earlier allows remote attac
Authentication bypass in the wpForo Forum WordPress plugin versions 3.1.0 and earlier allows remote unauthenticated atta
Stored cross-site scripting in wpForo Forum WordPress plugin before 3.1.2 allows a subscriber-level authenticated user t
Insecure Direct Object Reference (IDOR) in the wpForo Forum WordPress plugin before 3.1.2 allows any subscriber-level au
Unauthenticated SQL injection in the wpForo Forum WordPress plugin (versions 3.0.4 and earlier) allows remote attackers
Arbitrary file deletion in wpForo Forum WordPress plugin versions ≤2.4.16 allows authenticated attackers with subscriber
Auth. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch
Same weakness CWE-284 – Improper Access Control
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today