WordPress plugin
Asgaros Forum security & vulnerabilities
Unpatched vulnerability in the latest version
At least one vulnerability affects the latest version and no fix has been released. Deactivate the plugin or restrict access to the affected feature until the vendor ships a patch.
- Critical2
- High4
- Medium7
- Low0
All Asgaros Forum vulnerabilities
| Severity | Vulnerability | CVE | Published |
|---|---|---|---|
| Medium4.3 | Missing Authorization ≤3.4.0No patch available | CVE-2026-39779 | |
| Medium4.3 | Cross-Site Request Forgery to Subscription Settings Update ≤3.2.1Update to 3.3.0 | CVE-2025-12901 | |
| High7.5 | Unauthenticated SQL Injection ≤3.1.0Update to 3.2.0 | CVE-2025-11452 | |
| Medium6.4 | Authenticated (Contributor+) Stored Cross-Site Scripting ≤3.2.1Update to 3.3.0 | CVE-2025-39514 | |
| Medium4.3 | Authenticated (Subscriber+) Authorization Bypass ≤3.0.0Update to 3.1.0 | CVE-2025-32227 | |
| Medium4.3 | Cross-Site Request Forgery ≤2.8.0Update to 2.9.0 | CVE-2024-32440 | |
| Critical9.8 | Unauthenticated PHP Object Injection in prepare_unread_status ≤2.7.2Update to 2.8.0 | CVE-2024-22284 | |
| Medium6.6 | Insufficient Authorization to Authenticated (Admin+) Arbitrary File Upload <2.7.1Update to 2.7.1 | CVE-2023-5604 | |
| High8.8 | Cross-Site Request Forgery ≤2.1.0Update to 2.2.0 | CVE-2022-41608 | |
| High8.8 | SQL Injection <2.0.0Update to 2.0.0 | CVE-2022-0411 | |
| High7.2 | Admin+ SQL Injection via forum_id ≤1.15.14Update to 1.15.15 | CVE-2021-25045 | |
| Medium4.8 | Authenticated Stored Cross-Site Scripting ≤1.15.13Update to 1.15.14 | CVE-2021-42365 | |
| Critical9.8 | Unauthenticated SQL Injection ≤1.15.12Update to 1.15.13 | CVE-2021-24827 |
- Medium4.3Missing Authorization
≤3.4.0No patch available
- Medium4.3Cross-Site Request Forgery to Subscription Settings Update
≤3.2.1Update to 3.3.0
- High7.5Unauthenticated SQL Injection
≤3.1.0Update to 3.2.0
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
≤3.2.1Update to 3.3.0
- Medium4.3Authenticated (Subscriber+) Authorization Bypass
≤3.0.0Update to 3.1.0
- Medium4.3Cross-Site Request Forgery
≤2.8.0Update to 2.9.0
- Critical9.8Unauthenticated PHP Object Injection in prepare_unread_status
≤2.7.2Update to 2.8.0
- Medium6.6Insufficient Authorization to Authenticated (Admin+) Arbitrary File Upload
<2.7.1Update to 2.7.1
- High8.8Cross-Site Request Forgery
≤2.1.0Update to 2.2.0
- High8.8SQL Injection
<2.0.0Update to 2.0.0
- High7.2Admin+ SQL Injection via forum_id
≤1.15.14Update to 1.15.15
- Medium4.8Authenticated Stored Cross-Site Scripting
≤1.15.13Update to 1.15.14
- Critical9.8Unauthenticated SQL Injection
≤1.15.12Update to 1.15.13
Asgaros Forum: common questions
Does Asgaros Forum have known vulnerabilities?
Yes. VulnCrest Radar lists 13 known vulnerabilities in Asgaros Forum: 2 critical, 4 high, 7 medium. At least one is not fixed in the latest version.
How do I check which version of Asgaros Forum I run?
In wp-admin open Plugins → Installed Plugins; the version is shown under the name. Without admin access, our passive Check my site tool can often read it from public files.
What is the most recent Asgaros Forum vulnerability?
CVE-2026-39779, published Oct 9, 2026: Asgaros Forum <= 3.4.0 - Missing Authorization. Severity: Medium (CVSS 4.3).
Is any Asgaros Forum vulnerability listed in CISA KEV?
No. None of the known Asgaros Forum vulnerabilities is currently listed in the CISA KEV catalog.