The wpForo Forum WordPress plugin in any version prior to 3.1.6 allows an authenticated user with Subscriber-level access or higher to supply a custom value for a profile field that is deserialized without class name validation. This flaw is a classic PHP Object Injection condition; if the attacker supplies a serialized payload referencing a class capable of arbitrary code or file manipulation, the plugin will instantiate that object. The vulnerability by itself does not contain an object deserialization chain, but the description indicates that a POP (Property Oriented Programming) chain may be present in another installed wpForo Forum module. If such a chain is available, the injected object could lead to remote code execution, arbitrary file operations, or SQL injection.

WordPress sites that use the wpForo Forum plugin with a version older than 3.1.6. Any user with Subscriber or higher privilege who can edit profile fields is able to craft the malicious payload. The danger does not extend beyond the plugin’s handling of profile fields unless a compatible object chain exists in another component or plugin.

The CVSS score of 7.5 indicates a high-risk vulnerability. The exploit probability is not quantified due to a lack of EPSS data, and the vulnerability is not listed in the CISA KEV catalog. However, the flaw is exploitable by authenticated, on‑site users, which elevates its practical risk. Attackers would need to first obtain Subscriber or higher level access, then craft and submit a serialized payload through the profile field interface; if a suitable POP chain can be satisfied by the site’s installed plugins, the result could be full remote code execution. Given the severe potential impact and the readily available access model, the vulnerability warrants high risk treatment.