wpForo Forum

wpforo · plugin

Known security vulnerabilities for wpForo Forum. Find out in seconds which version runs on your site with WP Lens.

50 known vulnerabilities

6 critical · 19 exploitable without logging in · 3 with public exploit code · latest Sep 25, 2026

Listed on wordpress.org · latest 3.2.2 · last updated Sep 28, 2026 · 20K+ installs

wordpress.org status checked on Oct 5, 2026

Vulnerabilities

CVE-2026-49767unauthenticated≤ 3.1.0
WordPress wpForo Forum plugin <= 3.1.0 - Broken Authentication vulnerability
Critical 9.8
CVE-2026-49769unauthenticated≤ 3.1.0
WordPress wpForo Forum plugin <= 3.1.0 - PHP Object Injection vulnerability
Critical 9.8
CVE-2023-47868unauthenticated≤ 2.2.3
WordPress wpForo plugin <= 2.2.3 - Privilege Escalation vulnerability
Critical 9.8
CVE-2018-16613unauthenticated
An issue was discovered in the update function in the wpForo Forum plugin before 1.5.2 for WordPress.
Critical 9.8
CVE-2026-40798unauthenticated≤ 3.0.4
WordPress wpForo Forum plugin <= 3.0.4 - SQL Injection vulnerability
Critical 9.3
CVE-2026-42682unauthenticated≤ 3.0.6
WordPress wpForo Forum plugin <= 3.0.6 - Broken Access Control vulnerability
Critical 9.1
CVE-2026-28562unauthenticated→ 2.4.15
wpForo Forum 2.4.14 SQL Injection via Topics ORDER BY Parameter
High 8.8
CVE-2022-40192unauthenticated · needs a click≤ 2.0.9
WordPress wpForo Forum plugin <= 2.0.9 - Cross-Site Request Forgery (CSRF) vulnerability
High 8.8
CVE-2022-38144unauthenticated · needs a click≤ 2.0.5
WordPress wpForo Forum plugin <= 2.0.5 - Cross-Site Request Forgery (CSRF) vulnerability
High 8.8
CVE-2026-0910subscriber+≤ 2.4.13
wpForo Forum <= 2.4.13 - Authenticated (Subscriber+) PHP Object Injection
High 8.8
CVE-2023-47870login required≤ 2.2.6
WordPress wpForo Forum Plugin <= 2.2.6 is vulnerable to Broken Access Control and Cross Site Request Forgery (CSRF)
High 8.8
CVE-2023-2249subscriber+≤ 2.1.7
wpForo Forum <= 2.1.7 - Authenticated (Subscriber+) Local File Include, Server-Side Request Forgery, and PHAR Deserialization via file_get_contents
High 8.8
CVE-2022-40200subscriber+≤ 2.0.9
WordPress wpForo Forum plugin <= 2.0.9 - Auth. Arbitrary File Upload vulnerability
High 8.8
CVE-2026-57636contributor+≤ 3.0.9
WordPress wpForo Forum plugin <= 3.0.9 - SQL Injection vulnerability
High 8.5
CVE-2026-6248subscriber+≤ 3.0.5
wpForo Forum <= 3.0.5 - Authenticated (Subscriber+) Arbitrary File Deletion via Custom Profile Field File Path
High 8.1
CVE-2024-43288login required≤ 2.3.4
WordPress wpForo Forum plugin <= 2.3.4 - Insecure Direct Object References (IDOR) vulnerability
High 8.1
CVE-2025-31420login required≤ 2.4.2
WordPress wpForo Forum plugin <= 2.4.2 - Privilege Escalation vulnerability
High 7.6
CVE-2026-5097unauthenticated≤ 2.4.17
wpForo Forum <= 2.4.17 - Unauthenticated SQL Injection via 'referer' Parameter
High 7.5
CVE-2026-40767unauthenticated→ 3.0.2
WordPress wpForo Forum plugin < 3.0.2 - Broken Access Control vulnerability
High 7.5
CVE-2026-1581unauthenticated≤ 2.4.14
wpForo Forum <= 2.4.14 - Unauthenticated Time-Based SQL Injection
High 7.5
CVE-2025-66070unauthenticated≤ 2.4.10
WordPress wpForo Forum plugin <= 2.4.10 - Broken Access Control vulnerability
High 7.5
CVE-2025-13126unauthenticated≤ 2.4.12
wpForo Forum <= 2.4.12 - Unauthenticated SQL Injection
High 7.5
CVE-2025-4203unauthenticated≤ 2.4.8
wpForo Forum <= 2.4.8 - Unauthenticated SQL Injection via get_members Function
High 7.5
CVE-2024-43289unauthenticated≤ 2.3.4
WordPress wpForo Forum plugin <= 2.3.4 - Unauthenticated Sensitive Data Exposure vulnerability
High 7.5
CVE-2026-5809subscriber+≤ 3.0.2
wpForo Forum <= 3.0.2 - Authenticated (Subscriber+) Arbitrary File Deletion via 'data[body][fileurl]' Parameter
High 7.1
CVE-2026-28557login required→ 2.4.16
wpForo Forum < 2.4.16 Privilege Escalation via Role Synchronization Handler
High 7.1
CVE-2026-28559unauthenticated→ 2.4.16
wpForo Forum 2.4.14 Information Disclosure via Global RSS Feed
Medium 6.9
CVE-2026-93772subscriber+≤ 3.1.5
WordPress wpForo Forum plugin <= 3.1.5 - Cross Site Scripting (XSS) vulnerability
Medium 6.5
CVE-2026-4666subscriber+≤ 2.4.16
wpForo Forum <= 2.4.16 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Forum Post Modification via 'guestposting' Parameter
Medium 6.5
CVE-2025-11740subscriber+≤ 2.4.9
wpForo Forum <= 2.4.9 - Authenticated (Susbscriber+) SQL Injection
Medium 6.5
CVE-2025-0764subscriber+≤ 2.4.1
wpForo Forum <= 2.4.1 - Authenticated (Subscriber+) Arbitrary File Read in update
Medium 6.5
CVE-2024-3200contributor+≤ 2.3.3
wpForo Forum <= 2.3.3 - Authenticated (Contributor+) SQL Injection
Medium 6.5
CVE-2026-93747subscriber+≤ 3.1.6
wpForo Forum <= 3.1.6 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'telegram' Profile Field
Medium 6.4
CVE-2026-15021subscriber+≤ 3.1.1
wpForo Forum <= 3.1.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'location' Profile Field
Medium 6.4
CVE-2018-11709unauthenticated · needs a click
wpforo_get_request_uri in wpf-includes/functions.php in the wpForo Forum plugin before 1.4.12 for WordPress allows Unauthenticated Reflected
Medium 6.1
CVE-2022-40632unauthenticated · needs a click≤ 2.0.5
WordPress wpForo Forum plugin <= 2.0.5 - Cross-Site Request Forgery (CSRF) vulnerability
Medium 5.4
CVE-2025-4406subscriber+≤ 2.4.5
wpForo Forum <= 2.4.5 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Profile Avatar
Medium 5.4
CVE-2023-47869login required≤ 2.2.5
WordPress wpForo plugin <= 2.2.5 - Broken Access Control + CSRF vulnerability
Medium 5.4
CVE-2022-38055login required≤ 2.0.9
WordPress wpForo Forum plugin <= 2.0.9 - Auth. HTML Injection vulnerability
Medium 5.4
CVE-2023-47872login required≤ 2.2.3
WordPress wpForo Forum Plugin <= 2.2.3 is vulnerable to Cross Site Scripting (XSS)
Medium 5.4
CVE-2026-28556login required→ 2.4.16
wpForo Forum 2.4.14 Missing Authorization via Topic Management Form Handlers
Medium 5.3
CVE-2026-28555login required→ 2.4.16
wpForo Forum 2.4.14 Missing Authorization via Topic Close AJAX Handler
Medium 5.3
CVE-2026-28554login required→ 2.4.16
wpForo Forum 2.4.14 Missing Authorization via Post Approval AJAX Handler
Medium 5.3
CVE-2026-28558login required→ 2.4.16
wpForo Forum 2.4.14 Stored XSS via SVG Avatar File Upload
Medium 5.1
CVE-2026-28561high privilege→ 2.4.16
wpForo Forum 2.4.14 Stored XSS via Unescaped Forum Description in Templates
Medium 4.8
CVE-2026-28560high privilege→ 2.4.16
wpForo Forum 2.4.14 Stored XSS via Unsafe JSON Encoding in Inline Script
Medium 4.8
CVE-2026-91092subscriber+≤ 3.1.5
wpForo Forum <= 3.1.5 - Missing Authorization to Authenticated (Subscriber+) Guest Post Takeover via wpforo_post_edit Action / Forged comment_author_email Cooki
Medium 4.3
CVE-2025-58597login required≤ 2.4.6
WordPress wpForo Forum Plugin <= 2.4.6 - Insecure Direct Object References (IDOR) Vulnerability
Medium 4.3
CVE-2022-40206subscriber+≤ 2.0.5
WordPress wpForo Forum plugin <= 2.0.5 - Insecure direct object references (IDOR) vulnerability
Medium 4.3
CVE-2022-40205subscriber+≤ 2.0.5
WordPress wpForo Forum plugin <= 2.0.5 - Insecure direct object references (IDOR) vulnerability
Medium 4.3

The access label is read from the record's own text (e.g. “subscriber+”: subscriber and above). When the text names no role, CVSS decides between “login required” and “high privilege”; no role name is invented. “Needs a click”: the attack depends on a logged-in user following a link (CSRF, reflected XSS).

← Back to directory