Executive Summary

The wpForo Forum plugin for WordPress has a vulnerability in versions up to and including 3.0.5 that allows arbitrary file deletion. This happens because the Members::update() method does not properly validate or restrict file-type custom profile fields, letting authenticated users store arbitrary file paths instead of legitimate upload paths.

Additionally, the wpforo_fix_upload_dir() sanitization function used in ucf_file_delete() only remaps paths matching an expected pattern and then passes them directly to the unlink() function. This combination enables authenticated attackers with subscriber-level access or higher to delete arbitrary files on the server.

This vulnerability requires the presence of a file custom field, which depends on the wpForo - User Custom Fields addon plugin.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can have severe impacts because it allows authenticated users to delete arbitrary files on the server hosting the WordPress site.

Deleting critical files such as wp-config.php can lead to remote code execution, potentially giving attackers full control over the website and server.

Since the vulnerability requires only subscriber-level access, it lowers the barrier for attackers to exploit it, increasing the risk of site compromise and data loss.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability allows authenticated users with subscriber-level access and above to delete arbitrary files on the server, potentially leading to remote code execution. Such unauthorized file deletion and possible system compromise can result in breaches of data integrity and availability.

While the provided context does not explicitly mention compliance with standards like GDPR or HIPAA, the ability to delete critical files (e.g., wp-config.php) and execute remote code could lead to unauthorized access or loss of sensitive personal or health data, thereby potentially violating these regulations.

Useful 0 Not Useful 0