The wpForo Forum WordPress plugin prior to version 3.1.2 lacks validation that an AI chat conversation belongs to the requesting user before deleting its messages. This oversight is an instance of an Insecure Direct Object Reference (CWE‑639). Consequently, a subscriber‑level account can delete the AI chat message history of any other user, causing loss of data integrity and confidentiality.

wpForo Forum plugin versions earlier than 3.1.2 on WordPress sites where the AI chat feature is enabled. The flaw exists on any installation that allows subscriber accounts to issue delete requests.

The vulnerability is an Insecure Direct Object Reference; a logged‑in subscriber can craft a request to the delete endpoint with an arbitrary conversation ID, causing the message history of another user to be removed. The exploitation path is straightforward, requiring only authentication to the forum. With an EPSS score of less than 1%, the likelihood of exploitation is low but non‑negligible, and the vulnerability is not listed in CISA KEV. The risk remains elevated until the plugin is updated to a fixed release.