wpForo Forum for WordPress has a flaw that allows authenticated users with subscriber-level access to specify any file path in the data[body][fileurl] field during topic creation or editing. The plugin does not validate this value and stores it in postmeta. When an edit is submitted with wpftcf_delete[]=body, the plugin retrieves the stored path, uses wpforo_fix_upload_dir() which rewrites only valid upload paths and leaves other paths untouched, and then calls wp_delete_file() on it. This results in arbitrary file deletion, including critical files such as wp-config.php, and represents a CWE‑73 file path traversal weakness.

The vulnerability affects installations of the wpForo Forum plugin by tomdever running version 3.0.2 or older. The flaw resides in the topic_add() and topic_edit() handlers and the add_file() method invoked during editing.

The CVSS score of 7.1 indicates high impact. Exploitation requires authentication; any user with subscriber-level privileges or higher can trigger the deletion. While no public exploit has been documented and EPSS is unavailable, the logic is simple and could be abused on any site where the PHP process can write to the target file path. The vulnerability is not yet listed in the CISA KEV catalog.