CVE-2026-4666

The wpForo Forum plugin for WordPress versions up to 2.4.16 contains a variable overwrite vulnerability in the post editing functionality caused by insecure use of the extract() function on user-controlled input. An attacker can inject malicious parameters through the $_REQUEST['post'] array to bypass permission checks that normally restrict post editing capabilities. This affects all installations using the vulnerable plugin versions. The vulnerability has a CVSS score of 6.5 (Medium severity) with a network-based attack vector requiring low complexity and only low-level privileges (Subscriber access or above). While no code execution is possible, the impact is significant as authenticated attackers can modify the title, body, name, and email fields of any forum post regardless of access restrictions, including posts in private forums and posts authored by administrators or moderators. The attack is made more feasible by a hardcoded nonce that can be obtained by viewing any forum page. Current exploitation status shows minimal community attention with an EPSS score of 0.0001, indicating this vulnerability is not being actively exploited in the wild. There is no evidence of public exploit code availability or listing on the Known Exploited Vulnerabilities catalog. However, organizations running wpForo should treat this as a privilege escalation risk and apply patches promptly, particularly for installations hosting sensitive forum discussions.