WordPress CVEs

Description

The wpForo Forum plugin for WordPress is vulnerable to arbitrary file read due to insufficient input validation in the 'update' method of the 'Members' class in all versions up to, and including, 2.4.1. This makes it possible for authenticated attackers, with subscriber-level privileges or higher, to read arbitrary files on the server.

Affected WordPress components

• wpForo Forum Plugin · wpforo
  Confirmed match Active
  Up to and including 2.4.1
  View on WordPress.org

A confirmed match is backed by the plugin or theme slug. A possible match is based on the product name only and should be verified.

Affected products and versions

• tomdever wpForo Forum — Up to and including 2.4.1
• gvectors wpforo_forum — Before 2.4.2

References

• plugins.trac.wordpress.org https://plugins.trac.wordpress.org/changeset/3245711/wpforo Patch
• www.wordfence.com https://www.wordfence.com/threat-intel/vulnerabilities/id/8cd8ffcb-0a24-4e0a-a9f9-23501742715f?source=cve Third Party Advisory
• nvd.nist.gov Official NVD record