The wpForo Forum plugin, up to version 2.4.16, contains a flaw that allows an attacker with any authenticated role of Subscriber or higher to change the content of any forum post, including those in private forums or posts made by administrators and moderators. By sending a specially crafted request that includes a post[guestposting] parameter, the attacker can overwrite the $guestposting variable inside the Posts::edit() method, bypassing the authorization check. This results in integrity violations: the attacker can alter titles, bodies, names, and email fields, and inject rich HTML that is permitted by wpforo_kses(). The vulnerability is governed by CWE‑862 (Missing Authorization).

The vulnerability affects installations of the WordPress wpForo Forum plugin with versions 2.4.16 and earlier. The plugin is distributed by tomdever under the name "wpForo Forum". Users running these versions on any WordPress site are potentially exposed, regardless of the specific WordPress theme or hosting environment. No specific OS or PHP version constraints are listed in the advisory. The only known versions to be impacted are those equal to or earlier than 2.4.16; the fix began with version 2.4.17.

The CVSS score for this issue is 6.5, indicating moderate severity. The exploit does not require any special environment or privilege escalation beyond standard authenticated access, and the attacker can acquire a valid nonce by simply viewing any forum page. The lack of an EPSS score means that quantified exploit likelihood is not available, but the presence of a patch release indicates that the issue is actively tracked. In the absence of inclusion in the CISA KEV catalog, the vulnerability is likely not known to have been actively exploited in the wild, yet the simplicity of the attack vector warrants prompt remediation. The attacker may abuse the flaw by altering forum content or injecting malicious HTML that could harm other users if they interact with the modified posts.