The wpForo Forum plugin is vulnerable to an authorization bypass that enables an authenticated user with subscriber role or higher to take over a guest post. By invoking the wpforo_post_edit action and forging a comment_author_email cookie containing the target guest author's email, the attacker can change the post’s title, body, author name, and stored owner email address. This flaw requires that guest posting and editing be enabled and that the attacker knows the victim’s email address.

All releases of the wpForo Forum plugin up to and including version 3.1.5 are affected. The vendor tomdever maintains the plugin, but no specific patch version is listed in the data presented.

The CVSS base score of 4.3 indicates a moderate severity. EPSS is not available, and the vulnerability is not listed in the CISA KEV catalog. The attack vector is inferred to be limited to authenticated users, as the flaw permits only subscribers or higher to perform the takeover. An attacker must have legitimate site access, guest posting must be enabled, and the target email must be known. The overall risk is moderate, primarily affecting internal user integrity rather than remote code execution or system compromise.