CVE-2026-80513
Received Received - Intake

PHP Object Injection in wpForo Forum WordPress Plugin

Publication date: 2026-09-24

Last updated on: 2026-09-24

Assigner: WPScan

Description
The wpForo Forum WordPress plugin before 3.1.6 does not restrict which classes may be instantiated when it deserializes a user-supplied profile field value, allowing authenticated users with Subscriber-level access and above to inject a PHP Object. No POP chain is present in the wpForo Forum WordPress plugin before 3.1.6 itself; if one is present via another installed wpForo Forum WordPress plugin before 3.1.6 or , this could lead to remote code execution, arbitrary file operations, or SQL injection. This is an incomplete fix of CVE-2026-49769.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-24
Last Modified
2026-09-24
Generated
2026-09-24
AI Q&A
2026-09-24
EPSS Evaluated
N/A
NVD
CVE-2026-80513
EUVD
EUVD-2026-85796

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
wpforo forum to 3.1.6 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is an insecure deserialization issue in the wpForo Forum WordPress plugin before version 3.1.6. It allows authenticated users with Subscriber-level access or higher to inject PHP objects via profile fields because the plugin does not restrict which classes can be instantiated during deserialization of user-supplied data.

Detection Guidance

To detect this vulnerability, check the installed version of the wpForo Forum plugin. If it is below 3.1.6, the system is vulnerable. Use commands like 'wp plugin list' in WordPress or inspect the plugin directory for version details.

Impact Analysis

If an attacker exploits this vulnerability, they could potentially execute remote code, perform arbitrary file operations, or conduct SQL injection attacks. This is possible if another installed plugin or theme contains a Property-Oriented Programming chain that the injected object can leverage.

Compliance Impact

This vulnerability could lead to unauthorized access, data breaches, or manipulation of sensitive data due to potential remote code execution or SQL injection. Such incidents may violate GDPR's data protection requirements or HIPAA's safeguards for protected health information, depending on the compromised data.

Mitigation Strategies

Immediately update the wpForo Forum plugin to version 3.1.6 or later. Remove or disable the plugin if updating is not possible. Restrict user roles to the minimum required permissions to reduce attack surface.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-80513. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart