Introduction
A path traversal flaw in the wpForo Forum plugin for WordPress lets any registered subscriber delete arbitrary files on the hosting server. All it takes is a malicious forum post that the attacker writes and then deletes. On the more than 20,000 WordPress sites running wpForo, the lowest tier of authenticated user can remove critical files like wp-config.php, potentially forcing a complete site reset or a denial of service.
wpForo Forum, developed by the gVectors Team, is a full-featured discussion board plugin for WordPress with multiple forum layouts and community-building tools. It has over 20,000 active installations, requires PHP 7.2 or higher, and is the primary forum engine for a wide range of community-driven WordPress sites. It is widely used on sites that allow open user registration, which makes this vulnerability particularly relevant.
Technical Information
Root Cause: Missing Path Validation (CWE-22)
The vulnerability is classified under CWE-22, Improper Limitation of a Pathname to a Restricted Directory. The flaw is in the Posts.php class of the wpForo plugin. When a forum post is deleted, the plugin reads the post body to find and remove any attached files. In versions 2.4.16 and earlier, it does not sanitize or validate the file names and paths it extracts from the post body against directory traversal sequences such as ../.
Attack Flow
Exploitation is straightforward and needs only subscriber-level access:
-
The attacker registers a standard subscriber account on a WordPress site running a vulnerable version of wpForo (any version up to and including 2.4.16).
-
They create a forum post whose body contains a crafted path traversal string. The string references a file outside the intended attachment directory, for example by traversing up to
wp-config.phpor another critical server file. -
They delete the post they just created. During deletion, wpForo's file cleanup logic parses the post body, extracts what it interprets as attachment file paths, and tries to delete them from the filesystem.
-
Nothing checks that the resolved path stays within the permitted attachments directory, so the traversal string makes the application delete the attacker's chosen file. That can be any file on the server the web process has write permissions to.
The CVSS 3.1 vector string is AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, which breaks down as follows:
| Vector Component | Value | Meaning |
|---|---|---|
| Attack Vector | Network | Exploitable remotely |
| Attack Complexity | Low | No special conditions required |
| Privileges Required | Low | Subscriber account suffices |
| User Interaction | None | No victim action needed |
| Confidentiality Impact | High | Sensitive files can be removed, forcing exposure of defaults |
| Integrity Impact | High | Arbitrary file deletion modifies server state |
| Availability Impact | High | Deleting critical files causes service disruption |
Patch Approach in Version 2.4.17
Version 2.4.17 adds a two-stage validation process to the file deletion logic:
-
The update strips invalid character sequences from the extracted file path, which neutralizes traversal patterns.
-
Before deleting anything, the patched code checks that the file's resolved, real storage location falls within a permitted directory. If the resolved path escapes that boundary, the deletion is blocked.
You can review the code changes in the WordPress plugin changeset comparing Posts.php between versions 2.4.16 and 2.4.17.
Affected Systems and Versions
Every version of the wpForo Forum plugin from version 0 through version 2.4.16 (inclusive) is affected. Version 2.4.17 fixes the vulnerability.
| Condition | Detail |
|---|---|
| Affected Plugin | wpForo Forum for WordPress |
| Vulnerable Versions | 0 through 2.4.16 |
| Fixed Version | 2.4.17 |
| Required Privilege | Subscriber or higher (any authenticated user) |
| PHP Requirement | 7.2 or higher |
| Active Installations | Over 20,000 |
Sites that allow open user registration and run any version of wpForo before 2.4.17 carry the highest practical risk, because an attacker only has to create a free account to exploit the flaw.
Vendor Security History
The gVectors Team has addressed several high-severity vulnerabilities in wpForo over the past year. The pattern of disclosures suggests that administrators running this plugin should treat its security updates as urgent operational work.
| CVE Identifier | Publish Date | CVSS Score | Vulnerability Type | Affected Versions |
|---|---|---|---|---|
| CVE-2026-3666 | Apr 3, 2026 | 8.8 | Arbitrary File Deletion | Up to 2.4.16 |
| CVE-2026-1581 | Feb 18, 2026 | 7.5 | Unauthenticated Time-Based SQL Injection | Up to 2.4.14 |
| CVE-2026-0910 | Feb 10, 2026 | 8.8 | Authenticated PHP Object Injection | Up to 2.4.13 |
| CVE-2025-13126 | Dec 13, 2025 | 7.5 | Unauthenticated SQL Injection | Up to 2.4.12 |
| CVE-2025-31420 | Apr 2, 2025 | 8.8 | Authenticated Privilege Escalation | Up to 2.4.3 |
That is five high-severity vulnerabilities in roughly twelve months. Organizations that rely on wpForo should make sure they have automatic updates or monitoring in place for this plugin specifically.
Researchers Webbernaut and Leonid Semenenko discovered CVE-2026-3666. Wordfence was the CVE Numbering Authority and published the vulnerability details on April 3, 2026. The National Vulnerability Database published its record on April 4, 2026.
