CVE-2026-5809

OVERVIEW CVE-2026-5809 is a critical arbitrary file deletion vulnerability affecting the wpForo Forum plugin for WordPress through version 3.0.2. The flaw stems from a two-step logic error in the topic creation and editing functions that accepts unsanitized user-supplied data arrays and stores them as post metadata without field restrictions. This allows attackers to inject malicious file paths into the database, which are later processed without proper validation during file deletion operations. SEVERITY The vulnerability carries a CVSS v3.1 score of 7.1 (HIGH) with a network-based attack vector requiring only low complexity and low privileges (subscriber-level access or above). No user interaction is necessary for exploitation. The primary impact is availability, as attackers can delete arbitrary files writable by the PHP process, including critical WordPress configuration files such as wp-config.php. The EPSS score of 0.00038 indicates relatively low probability of active exploitation in the wild compared to the broader CVE landscape. EXPLOITATION STATUS There is no evidence of active exploitation, as the vulnerability does not appear on CISA's Known Exploited Vulnerabilities (KEV) catalog, and it is not currently featured on security community hot lists. The low EPSS score suggests minimal real-world targeting. However, the straightforward nature of the attack mechanism and moderate privilege requirements present a viable exploitation path for threat actors with authenticated access to WordPress installations running vulnerable wpForo versions.