Security Alert Summary
The wpForo Forum WordPress plugin (versions from 3.0.0 before 3.1.6) fails to verify the source of client-supplied IP address headers before using them to key a per-visitor rate limit on paid AI requests. An unauthenticated attacker can spoof that header to bypass the rate limit and exhaust a site owner\’s metered AI credits.
CVE Details
- CVE ID:
CVE-2026-80514 - Affected component: wpForo Forum WordPress plugin
- Affected versions: from 3.0.0 before 3.1.6
- Published: September 25, 2026 at 9:17:06 AM
- Last modified: September 25, 2026 at 1:25:16 PM
- CVSS v3.1 base score: 5.3 (MEDIUM)
- CVSS v3.1 vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L - Authentication / privileges / user interaction: No authentication required; privileges required: none; user interaction: none
- Primary impact: Confidentiality: none; Integrity: none; Availability: low (exhaustion of metered AI credits)
- CWE / weakness: CWE-348
Technical Details
The plugin uses a client-supplied IP address header to key a per-visitor rate limit for paid AI requests. The component does not verify the source or authenticity of that header before using it to determine usage quotas. Because the header can be supplied or spoofed by a remote client, an unauthenticated actor can present arbitrary values to appear as multiple distinct visitors or to impersonate another visitor, thereby bypassing the intended rate limit.
The practical impact described in the advisory is exhaustion of metered AI credits paid for by the site owner. The vulnerability exists due to missing validation of the client-supplied header used for rate-limiting decisions. No functions, endpoints, or additional internal checks are named in the provided information.
How This Could Impact Your Website
On a site where the site owner, internal staff (editors or moderators), and external contributors rely on built-in AI features, this issue could allow an unauthenticated attacker to consume paid AI credits by repeatedly spoofing the IP header used to track per-visitor usage. The immediate consequence is reduced availability of paid AI features for legitimate users, which can interfere with workflows that depend on those features for content drafting, moderation, or automated responses. While the CVSS data indicates no direct disclosure of sensitive data, reduced service availability can slow internal operations and indirectly increase the risk of social engineering or phishing if teams lose access to automated messaging tools they use to verify communications.
If you\’re unsure whether your site is affected or how to assess your current user roles and plugins, it may be worth having a professional review.
Recommended Actions
- Update the affected plugin as soon as a patched version is available.
- Review and reduce unnecessary user roles, especially contributors and other accounts with publishing or moderation capabilities.
- Enforce strong passwords and two-factor authentication for editors and administrators.
- Remove unused or unmaintained plugins that increase your overall attack surface.
- Monitor site activity and metered AI usage for unusual spikes that could indicate exploitation.
If you\’d like help reviewing your plugins, user roles, or overall WordPress security posture, our team at Freshy is happy to help.
