wpForo Forum 2.4.14 has a missing capability check that lets any authenticated user use the wpforo_synch_roles AJAX handler to bulk reassign all wpForo usergroups to arbitrary WordPress roles. This flaw allows an attacker to elevate privileges by granting themselves roles such as Administrator, giving full control of the site. The weakness is a privilege‑escalation flaw described by CWE‑862.

The vulnerability affects installations of the wpForo Forum plugin by gVectors Team, specifically version 2.4.14. Any WordPress site running this version, regardless of the number of users, is at risk because the usergroups admin page is accessible to all authenticated users.

With a CVSS score of 7.1 the flaw is considered high severity, but the EPSS score of less than 1% suggests a low current exploitation probability. The flaw is not listed in the CISA KEV catalog, indicating limited proven exploitation. Exploitation requires authenticated access to the site and the ability to invoke the wpforo_synch_roles AJAX endpoint, typically by navigating to the usergroups admin page, obtaining a nonce, and submitting a request that maps all usergroups to chosen WordPress roles. If successful, the attacker can gain administrative privileges and compromise the entire WordPress installation.