PHP Object Injection Vulnerability in wpForo Forum Plugin for WordPress

CVE-2026-0910

What is CVE-2026-0910?

The wpForo Forum plugin for WordPress is at risk of PHP Object Injection across all versions up to and including 2.4.13. This vulnerability arises from the unsafe deserialization of input in the 'wpforo_display_array_data' function, allowing attackers with Subscriber-level access or above to potentially inject malicious PHP objects. While the vulnerable plugin doesn’t include a proven payload injection chain, the risk escalates significantly if other plugins or themes with a PHP Object Injection chain are present. In such cases, attackers may gain the ability to delete files, access sensitive data, or execute arbitrary code, putting the website at a considerable security risk.

References