The flaw in the wpForo Forum plugin is caused by incorrect privilege assignment logic, which enables a user to gain higher permissions than intended. This misconfiguration directly permits an attacker to elevate their role to that of an administrator or any privileged user. The weakness is classified as CWE-266.

All installations of the Tomdever wpForo Forum plugin from the earliest released version up through version 2.4.2 are affected. Any WordPress site running one of those versions is potentially vulnerable.

The CVSS score of 7.6 marks this as a high‑severity flaw, while the EPSS score of less than 1% suggests a low probability of exploitation in the wild. The vulnerability is not listed in the CISA KEV catalog. The CVE description does not specify the exact attack vector, but it is inferred that an attacker might exploit the plugin through the web interface, potentially requiring an authenticated account. Successful exploitation would grant an attacker administrative control over the WordPress site, compromising confidentiality, integrity, and availability of site data.