WordPress plugin
wpForo Forum security & vulnerabilities
No known unpatched vulnerabilities in the latest version
All 59 known vulnerabilities are fixed in the latest release. If you run an older version, update to null or newer.
- Critical4
- High21
- Medium34
- Low0
All wpForo Forum vulnerabilities
- High7.5Authenticated (Subscriber+) Privilege Escalation to 'data[secondary_groupids]' CSV Parameter
≤3.2.2Update to 3.2.3
- High7.5Unauthenticated SQL Injection via 'data' Parameter
≤3.2.1Update to 3.2.2
- High7.5Unauthenticated SQL Injection via 'href[locale]' Parameter
≤3.2.2Update to 3.2.3
- High7.5Authenticated (Subscriber+) PHP Object Injection
≤3.1.5Update to 3.1.6
- High7.5Unauthenticated SQL Injection via 'referer' Parameter
≤2.4.17Update to 3.0.0
- High8.1Unauthenticated PHP Object Injection
≤3.1.0Update to 3.1.1
- High7.5Unauthenticated SQL Injection
≤3.0.4Update to 3.0.5
- High8.1Authenticated (Subscriber+) Arbitrary File Deletion via Custom Profile Field File Path
≤3.0.5Update to 3.0.6
- High7.1Authenticated (Subscriber+) Arbitrary File Deletion via 'data[body][fileurl]' Parameter
≤3.0.2Update to 3.0.3
- High8.8Authenticated (Subscriber+) Arbitrary File Deletion via Post Body
≤2.4.16Update to 2.4.17
- High7.5Unauthenticated Time-Based SQL Injection
≤2.4.14Update to 2.4.15
- High8.8Authenticated (Subscriber+) PHP Object Injection
≤2.4.13Update to 2.4.14
- High7.5Unauthenticated SQL Injection
≤2.4.12Update to 2.4.13
- High7.5Unauthenticated SQL Injection via get_members Function
≤2.4.8Update to 2.4.9
- High8.8Authenticated (Subscriber+) Privilege Escalation
≤2.4.3Update to 2.4.4
- Critical9.9Authenticated (Contributor+) SQL Injection
≤2.3.3Update to 2.3.4
- Critical9.8Unauthenticated Privilege Escalation
≤2.2.3Update to 2.2.4
- High8.8Authenticated (Subscriber+) Local File Include, Server-Side Request Forgery, and PHAR Deserialization via file_get_contents
≤2.1.7Update to 2.1.8
- High8.8Authenticated (Subscriber+) Arbitrary File Upload
≤2.0.9Update to 2.1.0
- High8.8Cross-Site Request Forgery
≤2.0.9Update to 2.1.0
- High8.8Cross-Site Request Forgery
≤2.0.5Update to 2.0.6
- High8.8Cross-Site Request Forgery
≤2.0.5Update to 2.0.6
- High8.8Cross-Site Request Forgery
≤1.6.5Update to 1.7.0
- Critical9.8Privilege Escalation
≤1.5.1Update to 1.5.2
- Critical9.8SQL Injection
≤1.4.12Update to 1.4.13
wpForo Forum: common questions
Does wpForo Forum have known vulnerabilities?
Yes. VulnCrest Radar lists 59 known vulnerabilities in wpForo Forum: 4 critical, 21 high, 34 medium. None are known to affect version null.
How do I check which version of wpForo Forum I run?
In wp-admin open Plugins → Installed Plugins; the version is shown under the name. Without admin access, our passive Check my site tool can often read it from public files.
What is the most recent wpForo Forum vulnerability?
CVE-2026-119164, published Nov 6, 2026: wpForo Forum <= 3.2.2 - Authenticated (Subscriber+) Privilege Escalation to 'data[secondary_groupids]' CSV Parameter. Severity: High (CVSS 7.5).
Is any wpForo Forum vulnerability listed in CISA KEV?
No. None of the known wpForo Forum vulnerabilities is currently listed in the CISA KEV catalog.