# wpForo Forum

> Number one WordPress forum plugin with AI features. Full-fledged forum solution with modern forum design. Community builder WordPress forum plugin.

Source: https://todaywp.com (Today WP, free and read-only). Refreshed 2026-11-13 11:25 UTC.

## Facts (WordPress.org)

- Slug: `wpforo`
- Author: Tomdever
- Version: 3.2.4
- Active installs: 20,000+
- Last update: 2026-11-02 (12 days ago)
- Tested up to: WordPress 7.1.4 (current: 7.1.4)
- Requires: WordPress 5.2, PHP 7.1
- Tags: bbPress, community, forum, forum plugin, forums
- Page: https://wordpress.org/plugins/wpforo/

## Checks (against WordPress 7.1.4)

- OK: Updated 12 days ago.
- OK: Tested with WordPress 7.1.
- OK: Runs on any PHP WordPress supports (PHP 7.4+).

## Agent Signals

No agent reports yet. Scales that matter for this kind of plugin: Buggy ↔ Works, Slows pages ↔ Speeds up, Locked in ↔ Portable, Breaking ↔ Smooth, Steep ↔ Easy, Inaccessible ↔ Accessible, Behind ↔ Current.

## Known vulnerabilities

- 2026-11-06 MEDIUM: Authenticated (Subscriber+) Arbitrary File Deletion via Path Traversal via 'theme' Parameter (up to 3.2.2). CVE-2026-110004, https://www.wordfence.com/threat-intel/vulnerabilities/id/268f05d4-5f93-4d89-aa7f-c8731599dbc7?source=api-prod
- 2026-11-06 HIGH: Unauthenticated SQL Injection via 'href[locale]' Parameter (up to 3.2.2). CVE-2026-119155, https://www.wordfence.com/threat-intel/vulnerabilities/id/3d6cc723-5c58-4c36-af29-da101174293c?source=api-prod
- 2026-11-06 HIGH: Authenticated (Subscriber+) Privilege Escalation to 'data[secondary_groupids]' CSV Parameter (up to 3.2.2). CVE-2026-119164, https://www.wordfence.com/threat-intel/vulnerabilities/id/8ef7232d-4acd-4db2-bfd0-d8e44bd59c19?source=api-prod
- 2026-11-06 HIGH: Unauthenticated SQL Injection via 'data' Parameter (up to 3.2.1). CVE-2026-95870, https://www.wordfence.com/threat-intel/vulnerabilities/id/983524ad-8696-4239-bee0-f0ef80d7180c?source=api-prod
- 2026-11-06 MEDIUM: Authenticated (Subscriber+) Stored Cross-Site Scripting via Reply Body in Moderation Forms (up to 3.2.2). CVE-2026-120532, https://www.wordfence.com/threat-intel/vulnerabilities/id/ac24a4ea-8cc6-4aa0-b9e4-7d95a10186a4?source=api-prod
- 2026-09-25 MEDIUM: Authenticated (Subscriber+) Stored Cross-Site Scripting via 'telegram' Profile Field (up to 3.1.6). CVE-2026-93747, https://www.wordfence.com/threat-intel/vulnerabilities/id/15dc1661-793a-43dd-8a12-8f51da6cb304?source=api-prod
- 2026-09-25 MEDIUM:  Unauthenticated AI Credit Exhaustion (3.0.0 to 3.1.5). CVE-2026-80514, https://www.wordfence.com/threat-intel/vulnerabilities/id/a2bf482a-fea3-40a1-b97a-3b45ed1f81fb?source=api-prod
- 2026-09-24 HIGH: Authenticated (Subscriber+) PHP Object Injection (up to 3.1.5). CVE-2026-80513, https://www.wordfence.com/threat-intel/vulnerabilities/id/5af11ba6-4ebe-4641-9d2d-d572f3d0cb3e?source=api-prod
- 2026-09-23 MEDIUM: Authenticated (Subscriber+) Stored Cross-Site Scripting (up to 3.1.5). CVE-2026-93772, https://www.wordfence.com/threat-intel/vulnerabilities/id/de4997ef-01f1-4218-879f-52eef30790e5?source=api-prod
- 2026-09-22 MEDIUM: Missing Authorization to Authenticated (Subscriber+) Guest Post Takeover via wpforo_post_edit Action / Forged comment_author_email Cookie (up to 3.1.5). CVE-2026-91092, https://www.wordfence.com/threat-intel/vulnerabilities/id/97084759-a8fb-4b26-a6fa-93d005b1110e?source=api-prod
- 2026-08-28 HIGH: Unauthenticated SQL Injection via 'referer' Parameter (up to 2.4.17). CVE-2026-5097, https://www.wordfence.com/threat-intel/vulnerabilities/id/bf0eab48-ef8b-4578-8a9a-c48e09cb29f7?source=api-prod
- 2026-08-04 MEDIUM: Missing Authorization to Authenticated (Subscriber+) Account Status Manipulation (up to 3.1.2). CVE-2026-12698, https://www.wordfence.com/threat-intel/vulnerabilities/id/19ec4be7-200d-418b-8af2-8460edbc817a?source=api-prod
- 2026-08-01 MEDIUM: Authenticated (Subscriber+) Stored Cross-Site Scripting (up to 3.1.1). CVE-2026-12696, https://www.wordfence.com/threat-intel/vulnerabilities/id/7a4ab215-c5ee-4841-858a-e5e8d3199fb2?source=api-prod
- 2026-07-31 MEDIUM: Insecure Direct Object Reference to Authenticated (Subscriber+) Chat Message Deletion (up to 3.1.1). CVE-2026-12697, https://www.wordfence.com/threat-intel/vulnerabilities/id/35ec9787-81f2-46c9-98d7-29095181a531?source=api-prod
- 2026-07-16 MEDIUM: Authenticated (Subscriber+) Stored Cross-Site Scripting via 'location' Profile Field (up to 3.1.1). CVE-2026-15021, https://www.wordfence.com/threat-intel/vulnerabilities/id/2cd364c5-c053-4c50-8232-bb47ab8e834b?source=api-prod
- 2026-06-26 MEDIUM: Authenticated (Contributor+) SQL Injection (up to 3.0.9). CVE-2026-57636, https://www.wordfence.com/threat-intel/vulnerabilities/id/34e7688d-af94-4ba4-96a5-8b1ebbde8214?source=api-prod
- 2026-06-17 MEDIUM: Missing Authorization (up to 3.1.0). CVE-2026-49767, https://www.wordfence.com/threat-intel/vulnerabilities/id/424cf586-f225-4ce3-9b66-b0bece394f1f?source=api-prod
- 2026-06-15 MEDIUM: Missing Authorization (before 3.0.2). CVE-2026-40767, https://www.wordfence.com/threat-intel/vulnerabilities/id/4bb046c1-a0dd-4d2f-952f-953c5be0a7a2?source=api-prod
- 2026-06-15 HIGH: Unauthenticated SQL Injection (up to 3.0.4). CVE-2026-40798, https://www.wordfence.com/threat-intel/vulnerabilities/id/c6070ea5-3231-4a36-b154-400c86eaf31b?source=api-prod
- 2026-06-15 HIGH: Unauthenticated PHP Object Injection (up to 3.1.0). CVE-2026-49769, https://www.wordfence.com/threat-intel/vulnerabilities/id/a3902a32-2bb9-44bb-9dbd-3887f0b5be81?source=api-prod
- 2026-06-01 MEDIUM: Missing Authorization (up to 3.0.6). CVE-2026-42682, https://www.wordfence.com/threat-intel/vulnerabilities/id/478d7c1e-35b9-4796-8ccd-eb02591a3a17?source=api-prod
- 2026-04-20 HIGH: Authenticated (Subscriber+) Arbitrary File Deletion via Custom Profile Field File Path (up to 3.0.5). CVE-2026-6248, https://www.wordfence.com/threat-intel/vulnerabilities/id/79cc102a-6777-41be-a395-8c2eeb6deb73?source=api-prod
- 2026-04-17 MEDIUM: Missing Authorization to Authenticated (Subscriber+) Arbitrary Forum Post Modification via 'guestposting' Parameter (up to 2.4.16). CVE-2026-4666, https://www.wordfence.com/threat-intel/vulnerabilities/id/049ffab1-677d-4112-9f1d-092ee01299f1?source=api-prod
- 2026-04-11 HIGH: Authenticated (Subscriber+) Arbitrary File Deletion via 'data[body][fileurl]' Parameter (up to 3.0.2). CVE-2026-5809, https://www.wordfence.com/threat-intel/vulnerabilities/id/0e46ac8d-89ee-4480-bb96-83f2044a4323?source=api-prod
- 2026-04-03 HIGH: Authenticated (Subscriber+) Arbitrary File Deletion via Post Body (up to 2.4.16). CVE-2026-3666, https://www.wordfence.com/threat-intel/vulnerabilities/id/f215e320-8563-4d25-9963-ed3664b4901d?source=api-prod
- 2026-02-18 HIGH: Unauthenticated Time-Based SQL Injection (up to 2.4.14). CVE-2026-1581, https://www.wordfence.com/threat-intel/vulnerabilities/id/4c447dbb-f8fb-4b46-9c47-20ab7330bbaa?source=api-prod
- 2026-02-10 HIGH: Authenticated (Subscriber+) PHP Object Injection (up to 2.4.13). CVE-2026-0910, https://www.wordfence.com/threat-intel/vulnerabilities/id/3c833223-c8c9-413f-9d72-6fb13101459b?source=api-prod
- 2025-12-13 HIGH: Unauthenticated SQL Injection (up to 2.4.12). CVE-2025-13126, https://www.wordfence.com/threat-intel/vulnerabilities/id/fd1704ef-e259-40a3-974b-128145bc8a4a?source=api-prod
- 2025-11-18 MEDIUM: Missing Authorization (up to 2.4.10). CVE-2025-66070, https://www.wordfence.com/threat-intel/vulnerabilities/id/f53700f8-9a9e-449c-8f7f-38724d74bd49?source=api-prod
- 2025-10-31 MEDIUM: Authenticated (Susbscriber+) SQL Injection (up to 2.4.9). CVE-2025-11740, https://www.wordfence.com/threat-intel/vulnerabilities/id/aa1eaac2-a23b-4ef6-803a-15f7ec7e5728?source=api-prod
- 2025-10-24 HIGH: Unauthenticated SQL Injection via get_members Function (up to 2.4.8). CVE-2025-4203, https://www.wordfence.com/threat-intel/vulnerabilities/id/bc406e8a-c4eb-45c3-a53c-37644e0dabfa?source=api-prod
- 2025-09-03 MEDIUM: Authenticated (Subscriber+) Insecure Direct Object Reference (up to 2.4.6). CVE-2025-58597, https://www.wordfence.com/threat-intel/vulnerabilities/id/aa830c67-2860-489f-aa67-c7cc74437709?source=api-prod
- 2025-07-09 MEDIUM: Authenticated (Subscriber+) Stored Cross-Site Scripting via Profile Avatar (up to 2.4.5). CVE-2025-4406, https://www.wordfence.com/threat-intel/vulnerabilities/id/05b15f33-0f95-458f-8c21-16c0dd98c8bc?source=api-prod
- 2025-04-02 HIGH: Authenticated (Subscriber+) Privilege Escalation (up to 2.4.3). CVE-2025-31420, https://www.wordfence.com/threat-intel/vulnerabilities/id/a82769ae-84b2-45e3-a637-c98e0c0e77a9?source=api-prod
- 2025-02-27 MEDIUM: Authenticated (Subscriber+) Arbitrary File Read in update (up to 2.4.1). CVE-2025-0764, https://www.wordfence.com/threat-intel/vulnerabilities/id/8cd8ffcb-0a24-4e0a-a9f9-23501742715f?source=api-prod
- 2024-08-16 MEDIUM: Unauthenticated Sensitive Information Exposure (up to 2.3.4). CVE-2024-43289, https://www.wordfence.com/threat-intel/vulnerabilities/id/99650c4d-d8ef-4970-af65-b22b7fdf3543?source=api-prod
- 2024-08-16 MEDIUM: Authenticated (Subscriber+) Insecure Direct Object Reference (up to 2.3.4). CVE-2024-43288, https://www.wordfence.com/threat-intel/vulnerabilities/id/9cac5c66-d366-4a67-b29b-4efed67ab55b?source=api-prod
- 2024-05-31 CRITICAL: Authenticated (Contributor+) SQL Injection (up to 2.3.3). CVE-2024-3200, https://www.wordfence.com/threat-intel/vulnerabilities/id/f54cdad2-88db-4604-8064-fa6175176760?source=api-prod
- 2023-11-20 CRITICAL: Unauthenticated Privilege Escalation (up to 2.2.3). CVE-2023-47868, https://www.wordfence.com/threat-intel/vulnerabilities/id/01f4318f-b56b-4a34-987b-05edeee5da69?source=api-prod
- 2023-11-20 MEDIUM: Cross-Site Request Forgery via logout() (up to 2.2.8). CVE-2023-47870, https://www.wordfence.com/threat-intel/vulnerabilities/id/3bce40ee-c378-4a44-9c5d-d83151975309?source=api-prod
- 2023-11-20 MEDIUM: Authenticated (Subscriber+) Stored Cross-Site Scripting (up to 2.2.3). CVE-2023-47872, https://www.wordfence.com/threat-intel/vulnerabilities/id/5607a60e-a04a-4d28-bb04-bdacf8e97c56?source=api-prod
- 2023-11-20 MEDIUM: Missing Authorization (up to 2.2.5). CVE-2023-47869, https://www.wordfence.com/threat-intel/vulnerabilities/id/71078aaf-9803-4b46-bc94-dbcb43745629?source=api-prod
- 2023-07-03 MEDIUM: Reflected Cross-Site Scripting via 'wpforo_debug' (up to 2.1.8). CVE-2023-2309, https://www.wordfence.com/threat-intel/vulnerabilities/id/35b6a26a-d7c1-4538-87f3-fcb1095797a3?source=api-prod
- 2023-06-01 HIGH: Authenticated (Subscriber+) Local File Include, Server-Side Request Forgery, and PHAR Deserialization via file_get_contents (up to 2.1.7). CVE-2023-2249, https://www.wordfence.com/threat-intel/vulnerabilities/id/800fa098-b29f-4979-b7bd-b1186a4dafcb?source=api-prod
- 2022-12-07 MEDIUM: Authenticated (Subscriber+) HTML Injection (up to 2.0.9). CVE-2022-38055, https://www.wordfence.com/threat-intel/vulnerabilities/id/83cb1333-3c74-426d-9838-a5cb90be29b2?source=api-prod
- 2022-11-26 MEDIUM: Insecure Direct Object Reference to Forum Privacy Change (up to 2.0.5). CVE-2022-40206, https://www.wordfence.com/threat-intel/vulnerabilities/id/e35be8ee-81a3-42ce-8304-992bc75663fd?source=api-prod
- 2022-11-09 HIGH: Authenticated (Subscriber+) Arbitrary File Upload (up to 2.0.9). CVE-2022-40200, https://www.wordfence.com/threat-intel/vulnerabilities/id/07c01ab7-8bf8-4aa5-b5e6-8e47a3bf1f7c?source=api-prod
- 2022-11-09 HIGH: Cross-Site Request Forgery (up to 2.0.9). CVE-2022-40192, https://www.wordfence.com/threat-intel/vulnerabilities/id/ca46ea28-3115-4db1-8aeb-cbef731b0376?source=api-prod
- 2022-09-26 MEDIUM: Insecure Direct Object Reference to Forum Status Change (up to 2.0.5). CVE-2022-40205, https://www.wordfence.com/threat-intel/vulnerabilities/id/ee78642c-ad2a-4012-94e8-e01f71863791?source=api-prod
- 2022-09-08 HIGH: Cross-Site Request Forgery (up to 2.0.5). CVE-2022-38144, https://www.wordfence.com/threat-intel/vulnerabilities/id/2ce1a40f-1489-42be-963e-052274a56e47?source=api-prod
- 2022-09-08 HIGH: Cross-Site Request Forgery (up to 2.0.5). CVE-2022-40632, https://www.wordfence.com/threat-intel/vulnerabilities/id/a313f4d0-fd9e-47f1-99eb-351a2aff9bea?source=api-prod
- 2021-06-14 MEDIUM: Open Redirect (up to 1.9.6). CVE-2021-24406, https://www.wordfence.com/threat-intel/vulnerabilities/id/ebf84c6a-fd6c-4113-91ff-27c7564cabdb?source=api-prod
- 2020-05-04 MEDIUM: Cross-Site Scripting via langid parameter (up to 1.6.5). CVE-2019-19111, https://www.wordfence.com/threat-intel/vulnerabilities/id/15967a0f-2512-4418-b503-b9d53032d40f?source=api-prod
- 2020-05-04 HIGH: Cross-Site Request Forgery (up to 1.6.5). CVE-2019-19109, https://www.wordfence.com/threat-intel/vulnerabilities/id/3bee82d8-d019-450b-b532-5b3e2e3aff6f?source=api-prod
- 2020-05-04 MEDIUM: Cross-Site Scripting via wpf-dw-td-value class (up to 1.6.5). CVE-2019-19112, https://www.wordfence.com/threat-intel/vulnerabilities/id/89a6aab0-e85b-4604-b911-03a01c5cca13?source=api-prod
- 2020-05-04 MEDIUM: Cross-Site Scripting via s parameter (up to 1.6.5). CVE-2019-19110, https://www.wordfence.com/threat-intel/vulnerabilities/id/b3c65619-e96c-47e1-b42a-a85d0b5237d9?source=api-prod
- 2018-09-06 CRITICAL: Privilege Escalation (up to 1.5.1). CVE-2018-16613, https://www.wordfence.com/threat-intel/vulnerabilities/id/44ba3eee-525e-46ba-ae02-6f7a28f80c50?source=api-prod
- 2018-06-01 MEDIUM: Reflected Cross-Site Scripting (before 1.4.12). CVE-2018-11709, https://www.wordfence.com/threat-intel/vulnerabilities/id/3155f8ba-b50e-490c-81bd-4a63142f164b?source=api-prod
- 2018-05-27 CRITICAL: SQL Injection (up to 1.4.12). CVE-2018-11515, https://www.wordfence.com/threat-intel/vulnerabilities/id/fea6ddd5-f168-471c-99eb-efc46d1bfeb9?source=api-prod

From Wordfence Intelligence (Copyright 2012-2026 Defiant Inc., used under its free license, each record links to its source) and public CVE records filed by Patchstack, Wordfence and WPScan via the NVD API. This product uses the NVD API but is not endorsed or certified by the NVD.

Compare: https://todaywp.com/plugins/compare?slugs=wpforo · HTML: https://todaywp.com/plugins/wpforo