wpForo Forum <= 3.0.2 — Authenticated (Subscriber+) Arbitrary File Deletion via 'data[body][fileurl]' Parameter

Am I affected?

• Check your version: in wp-admin go to Plugins → Installed Plugins and read the version under wpForo Forum.
• No admin access? Run a passive check of your site. It reads public files only.

What to do

1. Update to version 3.0.3, or a newer patched version
2. Rotate administrator passwords and application secrets if the site ran a vulnerable version while publicly reachable.
3. Watch wpForo Forum to get an email when the next vulnerability is published.

Advisory

Source description from Wordfence Intelligence, credited to Leonid Semenenko (lsemenenko).

The wpForo Forum plugin for WordPress is vulnerable to Arbitrary File Deletion in versions up to and including 3.0.2. This is due to a two-step logic flaw: the topic_add() and topic_edit() action handlers accept arbitrary user-supplied data[*] arrays from $_REQUEST and store them as postmeta without restricting which fields may contain array values. Because 'body' is included in the allowed topic fields list, an attacker can supply data[body][fileurl] with an arbitrary file path (e.g., wp-config.php or an absolute server path). This poisoned fileurl is persisted to the plugin's custom postmeta database table. Subsequently, when the attacker submits wpftcf_delete[]=body on a topic_edit request, the add_file() method retrieves the stored postmeta record, extracts the attacker-controlled fileurl, passes it through wpforo_fix_upload_dir() which only rewrites legitimate wpforo upload paths and returns all other paths unchanged, and then calls wp_delete_file() on the unvalidated path. This makes it possible for authenticated attackers, with subscriber-level access and above, to delete arbitrary files writable by the PHP process on the server, including critical files such as wp-config.

Exploits & references

Proof-of-concept & detection

No public proof-of-concept or detection template is known for this vulnerability.

Advisories & patches

• Advisorywordfence.com

Related CVEs

Timeline

1. Apr 10, 2026

   CVE published

   Severity high, CVSS 7.1

2. Nov 13, 2026

   Record last updated