CVE-2026-40767: WordPress wpForo Forum plugin < 3.0.2 - Broken Access Control vulnerability

Synopsis

A broken access control vulnerability in the wpForo Forum WordPress plugin (versions before 3.0.2) allows any unauthenticated attacker to reach protected forum data over the network without any credentials. The flaw is reachable remotely with no login required and no user interaction needed. Successful exploitation gives the attacker read access to data that should be restricted behind access controls, resulting in unauthorized disclosure of forum content. A patched-image rebuild at version 3.0.2 is available on HarborGuard for environments running an affected version.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The vulnerable endpoint is exposed over the network, so the attacker must be able to reach the WordPress site via HTTP/HTTPS from the internet or an internal network.

• AuthenticationNot required

  No account or credentials of any kind are needed; the attacker can exploit the flaw as a completely anonymous visitor.

• Victim interactionNot required

  The attacker does not need to trick or wait for any user to take an action; the request can be sent directly to the server.

• Attack complexityDetail

  The exploit is reliable and condition-free, requiring no race conditions, special memory layout, or other environmental factors to succeed.

Blast Radius

• The attacker reads forum content or user data that is intended to be access-controlled, such as private posts, member details, or restricted forum sections.
• No write or modify capability is indicated; the impact is limited to confidentiality of data stored or served by the wpForo plugin.
• Exposed data may include personally identifiable information or private communications depending on how the forum is configured, enabling follow-on phishing or credential-stuffing attempts.