CVE-2026-80514

Name of the Vulnerable Software and Affected Versions wpForo Forum WordPress plugin versions 3.0.0 through 3.1.5

Description The plugin fails to verify the source of client-supplied IP address headers used to key the per-visitor rate limit for paid AI requests. This allows unauthenticated attackers to bypass the rate limit by spoofing the header, which can lead to the exhaustion of the site owner's metered AI credits.

Recommendations Update wpForo Forum WordPress plugin to version 3.1.6 or later.