CVE-2026-6248
Arbitrary File Deletion in wpForo Plugin Enables Remote Code Execution
Publication date: 2026-04-20
Last updated on: 2026-04-20
Assigner: Wordfence
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| wpforo | forum_plugin | to 3.0.5 (inc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-22 | The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory. |
Attack-Flow Graph
AI Powered Q&A
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
This vulnerability allows authenticated users with subscriber-level access and above to delete arbitrary files on the server, potentially leading to remote code execution. Such unauthorized file deletion and possible system compromise can result in breaches of data integrity and availability.
While the provided context does not explicitly mention compliance with standards like GDPR or HIPAA, the ability to delete critical files (e.g., wp-config.php) and execute remote code could lead to unauthorized access or loss of sensitive personal or health data, thereby potentially violating these regulations.
Can you explain this vulnerability to me?
The wpForo Forum plugin for WordPress has a vulnerability in versions up to and including 3.0.5 that allows arbitrary file deletion. This happens because the Members::update() method does not properly validate or restrict file-type custom profile fields, letting authenticated users store arbitrary file paths instead of legitimate upload paths.
Additionally, the wpforo_fix_upload_dir() sanitization function used in ucf_file_delete() only remaps paths matching an expected pattern and then passes them directly to the unlink() function. This combination enables authenticated attackers with subscriber-level access or higher to delete arbitrary files on the server.
This vulnerability requires the presence of a file custom field, which depends on the wpForo - User Custom Fields addon plugin.
How can this vulnerability impact me? :
This vulnerability can have severe impacts because it allows authenticated users to delete arbitrary files on the server hosting the WordPress site.
Deleting critical files such as wp-config.php can lead to remote code execution, potentially giving attackers full control over the website and server.
Since the vulnerability requires only subscriber-level access, it lowers the barrier for attackers to exploit it, increasing the risk of site compromise and data loss.