The flaw is located in the wpForo Forum plugin version 2.4.14. The plugin’s approval endpoint performs a nonce check without verifying the requester’s role, allowing any authenticated subscriber to approve or unapprove posts arbitrarily. This missing authorization flaw lets an attacker transit moderation controls and alter the state of any forum post, potentially promoting inappropriate content or removing legitimate contributions. The weakness is classified as CWE‑862.

Only installations of wpForo Forum version 2.4.14 are known to be affected. The gVectors Team distributes this plugin for WordPress sites, and the CVE data does not list any other versions as impacted.

The CVSS score of 5.3 reflects moderate severity. An EPSS score below 1% indicates low but non‑zero exploitation probability. The vulnerability is not listed in CISA’s KEV catalog. Exploitation requires a valid logged‑in session and a valid nonce for the target post, which an attacker can obtain by visiting the post or by other means. Once the nonce is known, the attacker can send a POST request to the approval endpoint to set any post’s approval status, effectively bypassing moderation.