CVE-2026-119164
Deferred Deferred - Pending Action

Privilege Escalation in wpForo Forum WordPress Plugin

Publication date: 2026-11-07

Last updated on: 2026-11-07

Assigner: Wordfence

Description
The wpForo Forum plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 3.2.2 via the `data[secondary_groupids]` parameter of the `wpforo_action_profile_update` POST handler. This is due to a type-confusion flaw in the secondary_groupids authorization guard within the `Members::update()` function in `classes/Members.php`, where casting a scalar CSV string (e.g. `"0,1"`) with `(array)` before `array_map('intval', …)` and `array_filter()` produces an empty array — causing the guard's outer conditional, and the else-branch that would otherwise strip the field from the update, to be bypassed entirely — while `encode()`/`decode()` downstream correctly explodes the original CSV and persists the attacker-supplied group IDs to `wp_wpforo_profiles.secondary_groupids`. This makes it possible for authenticated attackers, with Subscriber-level access and above, to escalate their forum privileges to wpForo Administrator by injecting the privileged Admin group ID, granting access to the Forum Accesses editor and the ability to rewrite forum-wide capability policies for all members and edit arbitrary content owned by other users. Exploitation requires the attacker to have at least 3 approved wpForo posts to satisfy the plugin's default `min_number_posts_to_edit_account` antispam gate, along with a valid wpforo nonce obtained from their own account profile form.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-07
Last Modified
2026-11-07
Generated
2026-11-07
AI Q&A
2026-11-07
EPSS Evaluated
N/A
NVD
CVE-2026-119164
EUVD
EUVD-2026-119037

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
tomdever wpForo Forum From 0 (inc) to 3.2.2 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-269 The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

The wpForo Forum plugin for WordPress has a privilege escalation vulnerability in versions up to 3.2.2. An attacker with Subscriber-level access or higher can exploit a type-confusion flaw in the secondary_groupids parameter to escalate their privileges to wpForo Administrator. This is done by injecting the Admin group ID, allowing access to forum settings and content editing.

Detection Guidance

Check for unauthorized privilege escalation in wpForo by monitoring for changes to the secondary_groupids field in the wp_wpforo_profiles table. Look for Admin group ID injections (e.g., group ID 1) in user profiles. Review WordPress user roles for unexpected Administrator assignments.

Impact Analysis

An attacker could gain full administrative control over the wpForo forum, edit forum-wide policies, and modify content owned by other users. Exploitation requires at least 3 approved posts and a valid nonce from the attacker's profile.

Compliance Impact

This vulnerability could lead to unauthorized access and modification of sensitive user data, potentially violating GDPR (data protection) and HIPAA (health information privacy) requirements. Unauthorized privilege escalation may result in data breaches or compliance violations.

Mitigation Strategies

Update the wpForo Forum plugin to the latest version beyond 3.2.2. Temporarily restrict Subscriber-level users from editing profiles until patched. Monitor user roles and privileges for suspicious changes. Review and remove unauthorized Administrator accounts.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-119164. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...