CVE-2026-12697
Received Received - Intake

wpForo Forum AI Chat Message Deletion Vulnerability

Publication date: 2026-07-31

Last updated on: 2026-07-31

Assigner: WPScan

Description
The wpForo Forum WordPress plugin before 3.1.2 does not verify that an AI chat conversation belongs to the requesting user before deleting its messages, allowing users with a subscriber-level account to permanently delete the stored AI chat message history of any other user.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-31
Last Modified
2026-07-31
Generated
2026-07-31
AI Q&A
2026-07-31
EPSS Evaluated
N/A
NVD
CVE-2026-12697
EUVD
EUVD-2026-51437

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
wpforo forum to 3.1.2 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is in the wpForo Forum WordPress plugin before version 3.1.2. It allows users with a subscriber-level account to delete AI chat messages belonging to any other user without proper verification. This is due to missing checks to confirm message ownership before deletion.

Detection Guidance

Check if the wpForo Forum plugin version is 3.1.2 or earlier. If so, update to version 3.1.2 or later immediately. Monitor for unauthorized deletion of AI chat messages by subscriber-level users.

Impact Analysis

If you use the affected wpForo plugin, an attacker with a basic subscriber account could permanently delete your stored AI chat messages. This could lead to loss of important conversation history or data.

Compliance Impact

This vulnerability could potentially impact compliance with GDPR and HIPAA by allowing unauthorized deletion of user data. GDPR requires organizations to ensure data integrity and prevent unauthorized modifications, while HIPAA mandates protection of patient data. Unauthorized deletion of chat histories may violate these requirements by compromising data availability and integrity.

Mitigation Strategies

Update the wpForo Forum WordPress plugin to version 3.1.2 or later to address the vulnerability.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-12697. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart