Arbitrary File Deletion Vulnerability in wpForo Forum Plugin for WordPress

CVE-2026-6248

What is CVE-2026-6248?

The wpForo Forum plugin for WordPress has a critical vulnerability that allows authenticated users to delete arbitrary files from the server. This issue arises from two key flaws: first, the Members::update() method fails to validate the paths of file-type custom profile fields, allowing users to input unauthorized file paths. Second, the wpforo_fix_upload_dir() function only sanitizes paths that match a specific pattern, which can lead to the execution of the unlink() function on malicious paths. With subscriber-level access and higher, attackers can exploit these vulnerabilities to delete crucial files, such as wp-config.php, potentially enabling remote code execution.

References