4.3
Medium
CVE-2026-12698 The wpForo Forum WordPress plugin before 3.1.3 does not restrict which profile fields a member may set when editing…
Description
The wpForo Forum WordPress plugin before 3.1.3 does not restrict which profile fields a member may set when editing their own account, allowing users with a subscriber-level account to write administrator-controlled account-state and reputation fields on their own profile, including self-activating a pending or banned account and forging their forum reputation score.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| wpForo Forum 3.1 | earliest → < 3.1.3 | 3.1.3 |
Other CVEs of wpForo Forum
The 6 CVEs of wpForo Forum →
CVE-2026-80514
The wpForo Forum WordPress plugin from 3.0.0 before 3.1.6 does not verify the source of client-supplied IP address…
5.3
Medium
CVE-2026-80513
The wpForo Forum WordPress plugin before 3.1.6 does not restrict which classes may be instantiated when it…
7.5
High
CVE-2026-12696
The wpForo Forum WordPress plugin before 3.1.2 does not sanitize and escape a user profile field before outputting it…
5.4
Medium
CVE-2026-12697
The wpForo Forum WordPress plugin before 3.1.2 does not verify that an AI chat conversation belongs to the requesting…
5.4
Medium