Arbitrary File Deletion Vulnerability in wpForo Forum Plugin for WordPress
CVE-2026-5809

7.1HIGH

Key Information:

Vendor

WordPress
Status
WPforo Forum
Vendor
CVE Published:
11 April 2026

What is CVE-2026-5809?

The wpForo Forum plugin for WordPress allows authenticated users to delete arbitrary files on the server due to a flaw in handling user-supplied data. Specifically, the plugin's topic_add() and topic_edit() action handlers accept unrestricted data from $_REQUEST, allowing attackers to input their own file paths through the 'body' field. This file path can lead to the deletion of crucial files such as wp-config.php, thus jeopardizing the entire WordPress site. This vulnerability affects versions up to and including 3.0.2 and requires only subscriber-level access or higher for exploitation.

Affected Version(s)

wpForo Forum 0 <= 3.0.2

References

https://www.wordfence.com/threat-intel/vulnerabilities/id...
https://plugins.trac.wordpress.org/changeset/3503313/wpforo
https://plugins.trac.wordpress.org/browser/wpforo/tags/3....

CVSS V3.1

Score:
7.1
Severity:
HIGH
Confidentiality:
Low
Integrity:
None
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Leonid Semenenko
.