The vulnerability allows an authenticated user with a subscriber-level role or higher to delete any file on the server by exploiting a path traversal flaw in the wpForo Forum "theme_delete" function. When certain critical files, such as the WordPress configuration file, are removed, it can enable a remote code execution chain. The flaw stems from insufficient validation of the "theme" parameter that is passed to the deletion routine.

All installations of the wpForo Forum plugin for WordPress with versions 3.2.2 and earlier, including the default WordPress role "Subscriber", are impacted. The issue exists in the primary plugin code base and is not limited to a specific submodule. The vulnerability is specific to the wpForo Forum plugin distributed by tomdever.

The CVSS score of 6.5 indicates moderate severity, and the exploit is only viable on sites where administrators have configured a custom secondary user group that grants the "Manage Themes" capability to subscriber-level accounts. Because the path traversal requires this specific configuration and an authenticated session, the likelihood of exploitation is not high in typical deployments, and the vulnerability is not listed in the CISA KEV catalog. However, when the configuration is present, the attack path is straightforward: submit a request with a manipulated theme parameter and a crafted secondary group ID, then trigger the delete action to remove arbitrary files.