The wpForo Forum plugin has an insecure direct object reference (IDOR) flaw that permits an attacker to bypass access controls by manipulating user-supplied identifiers. An attacker can read or modify forum data that should be restricted, jeopardizing confidentiality and integrity. This weakness is identified as CWE‑639.

The vulnerability impacts the Tomdever wpForo Forum WordPress plugin for all releases from its earliest version through version 2.4.6. Any WordPress site deploying this plugin within that version range is potentially vulnerable.

The CVSS score of 4.3 reflects low to moderate severity, and the EPSS score of less than 1% indicates a very low exploitation likelihood at present. The vulnerability is not listed in the CISA KEV catalog. Exploitation would likely require an attacker to modify object identifiers in forum requests, a task that can be performed with or without prior authentication depending on the site’s configuration. Consequently, the overall risk is low, but the attack vector is straightforward once the flaw is known.