The wpForo Forum plugin for WordPress suffers from PHP Object Injection caused by deserialization of untrusted input within the wpforo_display_array_data function. This flaw allows attackers who can log in with a Subscriber role or higher to inject malicious PHP objects. Without a second‑party plugin or theme that supplies a useful POP chain the flaw alone does not let an attacker read data, delete files, or execute code. If such a chain exists, the attacker can perform destructive or exfiltration actions depending on the objects in the chain.

The vulnerability is limited to the wpForo Forum plugin versions up to and including 2.4.13. Users running the 2.4.14 release or later are not affected. Sites that run earlier releases and also have other WordPress plugins or themes that contain vulnerable deserialization logic or POP chains are at risk.

The flaw carries a high severity CVSS score of 8.8, but the EPSS score is below 1%, indicating a low probability of exploitation in the wild. The vulnerability is not listed in the CISA KEV catalogue. Exploitability requires an authenticated user with a Subscriber or higher role and the presence of an additional POP chain to trigger code execution or file manipulation.