5.3
Moyenne
CVE-2026-80514 The wpForo Forum WordPress plugin from 3.0.0 before 3.1.6 does not verify the source of client-supplied IP address…
Description
The wpForo Forum WordPress plugin from 3.0.0 before 3.1.6 does not verify the source of client-supplied IP address headers before using them to key its per-visitor rate limit on paid AI requests, allowing unauthenticated attackers to bypass the limit by spoofing the header and exhaust the site owner's metered AI credits.
Produits et versions touchés
| Produit | Versions touchées | Corrigé en |
|---|---|---|
| wpForo Forum 3.0 | 3.0.0 → < 3.1.6 | 3.1.6 |
Autres CVE de wpForo Forum
Les 6 CVE de wpForo Forum →
CVE-2026-80513
The wpForo Forum WordPress plugin before 3.1.6 does not restrict which classes may be instantiated when it…
7.5
Élevée
CVE-2026-12698
The wpForo Forum WordPress plugin before 3.1.3 does not restrict which profile fields a member may set when editing…
4.3
Moyenne
CVE-2026-12696
The wpForo Forum WordPress plugin before 3.1.2 does not sanitize and escape a user profile field before outputting it…
5.4
Moyenne
CVE-2026-12697
The wpForo Forum WordPress plugin before 3.1.2 does not verify that an AI chat conversation belongs to the requesting…
5.4
Moyenne