Description
The wpForo Forum plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 3.2.2 via the `data[secondary_groupids]` parameter of the `wpforo_action_profile_update` POST handler. This is due to a type-confusion flaw in the secondary_groupids authorization guard within the `Members::update()` function in `classes/Members.php`, where casting a scalar CSV string (e.g. `"0,1"`) with `(array)` before `array_map('intval', …)` and `array_filter()` produces an empty array — causing the guard's outer conditional, and the else-branch that would otherwise strip the field from the update, to be bypassed entirely — while `encode()`/`decode()` downstream correctly explodes the original CSV and persists the attacker-supplied group IDs to `wp_wpforo_profiles.secondary_groupids`. This makes it possible for authenticated attackers, with Subscriber-level access and above, to escalate their forum privileges to wpForo Administrator by injecting the privileged Admin group ID, granting access to the Forum Accesses editor and the ability to rewrite forum-wide capability policies for all members and edit arbitrary content owned by other users. Exploitation requires the attacker to have at least 3 approved wpForo posts to satisfy the plugin's default `min_number_posts_to_edit_account` antispam gate, along with a valid wpforo nonce obtained from their own account profile form.
Published: 2026-11-07
Score: 7.5 High
EPSS: < 1% Very Low
KEV: No
Impact: Privilege Escalation
Action: Immediate Patch
AI Analysis

Impact

The vulnerability is a type‑confusion flaw in the wpForo Forum plugin’s profile update routine. By sending a specially crafted CSV string in the data[secondary_groupids] POST field, an authenticated user with Subscriber level access can bypass the authorization guard and inject a privileged Admin group ID. The token is then stored in the backend, granting the user the Administrator role for wpForo, including full access to forum capability policies and the ability to edit content owned by any user.

Affected Systems

Affected is the wpForo Forum plugin for WordPress (vendor Tomdever). All releases up to and including 3.2.2 are vulnerable. Versions 3.2.3 and later incorporate the fix.

Risk and Exploitability

The flaw carries a CVSS score of 7.5 and is not yet listed in the CISA KEV catalog. EPSS data is not available, but the need for a valid nonce and the antispam requirement that a user have at least three approved posts limits the attack surface to authenticated individuals who have already engaged with the forum. The exploit path is straightforward once these prerequisites are met: submit the malicious CSV, submit the form, and the plugin persists the Admin group ID. Because the vulnerability requires authenticated access, it is not directly exploitable by unauthenticated attackers, yet the potential for abuse inside a community is high if members gain higher privileges.

Generated by OpenCVE AI on November 7, 2026 at 10:22 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade wpForo Forum to version 3.2.3 or newer, which removes the type‑confusion bug in the profile update handler.
  • If an upgrade is not immediately possible, remove the data[secondary_groupids] field from the profile update form or block modifications to that field for non‑administrator roles.
  • Configure WordPress to enforce stricter approval workflows for posts so that the min_number_posts_to_edit_account rule is elevated, increasing the effort required by an attacker to satisfy the prerequisite.
  • Invalidate existing wpforo nonces by clearing all nonces or forcing users to log out and back in, reducing the window in which the vulnerability can be abused.

Generated by OpenCVE AI on November 7, 2026 at 10:22 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Sat, 07 Nov 2026 11:45:00 +0000

Type Values Removed Values Added
First Time appeared Tomdever
Tomdever wpforo Forum
Wordpress-extensions
Wordpress-extensions wpforo Forum
Vendors & Products Tomdever
Tomdever wpforo Forum
Wordpress-extensions
Wordpress-extensions wpforo Forum

Sat, 07 Nov 2026 09:30:00 +0000

Type Values Removed Values Added
Description The wpForo Forum plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 3.2.2 via the `data[secondary_groupids]` parameter of the `wpforo_action_profile_update` POST handler. This is due to a type-confusion flaw in the secondary_groupids authorization guard within the `Members::update()` function in `classes/Members.php`, where casting a scalar CSV string (e.g. `"0,1"`) with `(array)` before `array_map('intval', …)` and `array_filter()` produces an empty array — causing the guard's outer conditional, and the else-branch that would otherwise strip the field from the update, to be bypassed entirely — while `encode()`/`decode()` downstream correctly explodes the original CSV and persists the attacker-supplied group IDs to `wp_wpforo_profiles.secondary_groupids`. This makes it possible for authenticated attackers, with Subscriber-level access and above, to escalate their forum privileges to wpForo Administrator by injecting the privileged Admin group ID, granting access to the Forum Accesses editor and the ability to rewrite forum-wide capability policies for all members and edit arbitrary content owned by other users. Exploitation requires the attacker to have at least 3 approved wpForo posts to satisfy the plugin's default `min_number_posts_to_edit_account` antispam gate, along with a valid wpforo nonce obtained from their own account profile form.
Title wpForo Forum <= 3.2.2 - Authenticated (Subscriber+) Privilege Escalation to 'data[secondary_groupids]' CSV Parameter
Weaknesses CWE-269
References
Metrics cvssV3_1

{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H'}

Subscriptions

Tomdever Wpforo Forum
Wordpress-extensions Wpforo Forum
cve-icon MITRE

Status: PUBLISHED

Assigner: Wordfence

Published:

Updated: 2026-11-07T09:25:47.581Z

Reserved: 2026-10-29T14:59:18.253Z

Link: CVE-2026-119164

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Deferred

Published: 2026-11-07T10:17:07.337

Modified: 2026-11-07T10:17:07.487

Link: CVE-2026-119164

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-11-07T11:30:13Z

Weaknesses
  • CWE-269

    Improper Privilege Management