5.4
Medium
CVE-2026-12697 The wpForo Forum WordPress plugin before 3.1.2 does not verify that an AI chat conversation belongs to the requesting…
Description
The wpForo Forum WordPress plugin before 3.1.2 does not verify that an AI chat conversation belongs to the requesting user before deleting its messages, allowing users with a subscriber-level account to permanently delete the stored AI chat message history of any other user.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| wpForo Forum 3.1 | earliest → < 3.1.2 | 3.1.2 |
Other CVEs of wpForo Forum
The 6 CVEs of wpForo Forum →
CVE-2026-80514
The wpForo Forum WordPress plugin from 3.0.0 before 3.1.6 does not verify the source of client-supplied IP address…
5.3
Medium
CVE-2026-80513
The wpForo Forum WordPress plugin before 3.1.6 does not restrict which classes may be instantiated when it…
7.5
High
CVE-2026-12698
The wpForo Forum WordPress plugin before 3.1.3 does not restrict which profile fields a member may set when editing…
4.3
Medium
CVE-2026-12696
The wpForo Forum WordPress plugin before 3.1.2 does not sanitize and escape a user profile field before outputting it…
5.4
Medium