CVE-2026-80514
Deferred Deferred - Pending Action

wpForo Forum IP Spoofing Bypass in AI Rate Limit

Publication date: 2026-09-25

Last updated on: 2026-09-25

Assigner: WPScan

Description
The wpForo Forum WordPress plugin from 3.0.0 before 3.1.6 does not verify the source of client-supplied IP address headers before using them to key its per-visitor rate limit on paid AI requests, allowing unauthenticated attackers to bypass the limit by spoofing the header and exhaust the site owner's metered AI credits.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-25
Last Modified
2026-09-25
Generated
2026-10-15
AI Q&A
2026-09-25
EPSS Evaluated
2026-10-14
NVD
CVE-2026-80514
EUVD
EUVD-2026-86626

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
wpforo forum to 3.1.6 (exc)
wpforo forum to 3.1.5 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-348 The product has two different sources of the same data or information, but it uses the source that has less support for verification, is less trusted, or is less resistant to attack.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

The wpForo Forum WordPress plugin versions 3.0.0 to 3.1.5 has a flaw where it does not verify the source of client-supplied IP address headers. This allows attackers to spoof the IP address and bypass rate limits on paid AI requests, exhausting the site owner's metered AI credits.

Detection Guidance

Check if your wpForo Forum plugin version is between 3.0.0 and 3.1.5. Monitor for unusual AI request patterns or credit exhaustion events. Review server logs for repeated requests with varying spoofed IP headers.

Impact Analysis

If you use the affected wpForo Forum plugin versions, an attacker could exploit this to drain your paid AI service credits by repeatedly making requests with spoofed IP addresses. This could lead to unexpected costs or service disruptions for legitimate users.

Compliance Impact

This vulnerability does not directly affect compliance with GDPR or HIPAA as it involves resource exhaustion rather than data exposure or privacy violations. However, if AI credits are tied to paid services, improper billing or service disruption could indirectly impact operational compliance with financial or service-level agreements.

Mitigation Strategies

Update the wpForo Forum plugin to version 3.1.6 or later immediately. Disable paid AI features if not essential. Implement server-side IP validation for rate limiting instead of relying on client headers.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-80514. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart