CVE-2026-91092

Name of the Vulnerable Software and Affected Versions wpForo Forum versions prior to 3.1.6

Description An authorization bypass exists because the plugin fails to properly verify if a user is authorized to perform specific actions. Authenticated attackers with subscriber-level access or higher can take over a guest author's forum post to modify the title, body, author name, and stored owner email address. This exploitation occurs via the wpforo post edit action and requires a forged comment author email cookie. The attack is only possible if guest posting and editing are enabled and the attacker knows the target guest author's email address.

Recommendations Update wpForo Forum to version 3.1.6 or later. As a temporary mitigation, disable guest posting and editing features on the forum.