Security Alert Summary
The wpForo Forum plugin for WordPress contains an authorization bypass in versions up to and including 3.1.5. An authenticated attacker with subscriber-level access or higher can modify another guest author’s forum post – including title, body, author name, and the stored owner email address – when guest posting and editing are enabled and the attacker knows the target guest author’s email address.
CVE Details
- CVE ID: CVE-2026-91092
- Affected component: wpForo Forum plugin for WordPress
- Affected versions: All versions up to and including 3.1.5
- Published: September 22, 2026 at 8:16 AM UTC
- Last modified: September 22, 2026 at 8:16 AM UTC
- CVSS v3.1 base score: 4.3
- CVSS v3.1 severity: MEDIUM
- CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
- Authentication / privileges / user interaction: Requires an authenticated user with low privileges (subscriber-level access or higher). No user interaction is required.
- Primary impact: Confidentiality: None; Integrity: Low; Availability: None
- CWE / weakness: CWE-862 (Missing Authorization)
Technical Details
The vulnerability is an authorization bypass: the plugin does not properly verify that the acting user is authorized to perform certain post edit actions. As a result, an authenticated attacker with subscriber-level access or higher can modify another guest author’s forum post when guest posting and editing are enabled and the attacker knows the target guest author’s email address.
Code paths referenced in the advisory include files in the plugin repository such as classes/Actions.php, classes/Members.php, classes/Posts.php, includes/functions.php, and includes/hooks.php. These links indicate the areas of the plugin where authorization checks were not enforced or were missing. The issue allows modification of post title, body, author name, and the stored owner email address for guest-authored posts.
The impact is limited to unauthorized modification of guest posts and associated stored metadata; it does not indicate elevation to full site compromise or availability disruption per the CVSS assessment.
How This Could Impact Your Website
Consider a site with multiple users: a site owner who manages settings, internal staff who moderate forums, and external contributors or contractors who submit guest posts. If guest posting and editing are enabled, an authenticated subscriber or compromised contributor account could be used to alter another guest author’s post content and the stored owner email address. This could lead to:
- Modified forum content that misrepresents guest contributors or confuses readers.
- Manipulation of stored owner email addresses, which could be used to craft targeted social engineering or phishing campaigns against specific contributors or staff.
- Trust and reputation issues if guest content is altered without the original author being aware.
If youre unsure whether your site is affected or how to assess your current user roles and plugins, it may be worth having a professional review of your setup.
Recommended Actions
- Update the affected plugin as soon as a patched version is available.
- Review and reduce unnecessary user roles, especially contributors and subscriber accounts that can post or edit when not required.
- Enforce strong passwords and two-factor authentication for editors and administrators.
- Disable guest posting or guest editing if it is not required for your forum use case.
- Remove unused or unmaintained plugins.
- Monitor site activity and forum edits for unusual behavior, such as unexpected changes to guest posts or author metadata.
If youd like help reviewing your plugins, user roles, or overall WordPress security posture, our team at Freshy is happy to help.
References
- https://plugins.trac.wordpress.org/browser/wpforo/tags/3.1.5/classes/Actions.php#L806
- https://plugins.trac.wordpress.org/browser/wpforo/tags/3.1.5/classes/Members.php#L3704
- https://plugins.trac.wordpress.org/browser/wpforo/tags/3.1.5/classes/Posts.php#L319
- https://plugins.trac.wordpress.org/browser/wpforo/tags/3.1.5/includes/functions.php#L2820
- https://plugins.trac.wordpress.org/browser/wpforo/tags/3.1.5/includes/hooks.php#L1004
- https://plugins.trac.wordpress.org/changeset?reponame=&old=3702319%40wpforo&new=3702319%40wpforo
- https://www.wordfence.com/threat-intel/vulnerabilities/id/97084759-a8fb-4b26-a6fa-93d005b1110e?source=cve
