Insufficient input validation in the Members class update method allows authenticated users with subscriber-level privileges or higher to request arbitrary file paths and read the contents of any file on the server. The attacker could therefore access configuration files, logs, or other files that contain sensitive data; the potential exposure of credentials is inferred from the ability to read arbitrary files.

The vulnerability affects the wpForo Forum WordPress plugin, developed by TomDever, in all releases up to and including version 2.4.1. Site operators using these versions should verify the installed version and plan a timely upgrade.

The CVSS base score of 6.5 indicates a medium severity vulnerability with a threat to confidentiality. The EPSS score of less than 1% shows that exploitation is currently unlikely, and the issue is not listed in the CISA KEV catalog. Because the flaw requires authentication, an attacker must compromise a subscriber account or create one, after which the plugin can be directed to read any file within the server’s filesystem.