CVE-2026-5809

Name of the Vulnerable Software and Affected Versions wpForo Forum plugin for WordPress versions prior to 3.0.3

Description A logic flaw exists in the topic add() and topic edit() action handlers that allows authenticated users with subscriber-level access and above to delete arbitrary files writable by the PHP process. The issue occurs because the handlers accept arbitrary user-supplied data arrays from $ REQUEST and store them as postmeta. An attacker can provide a malicious file path via the data[body][fileurl] parameter, which is then persisted in the database. When a subsequent topic edit request is made using the wpftcf delete[]=body parameter, the add file() method retrieves the stored path, processes it through wpforo fix upload dir(), and passes the unvalidated path to wp delete file(), enabling the deletion of critical files such as wp-config.php.

Recommendations Update the wpForo Forum plugin for WordPress to version 3.0.3 or later.