CVE-2026-42682: WordPress wpForo Forum plugin <= 3.0.6 - Broken Access Control vulnerability

Synopsis

This is a broken access control vulnerability in the wpForo Forum WordPress plugin, affecting all versions through 3.0.6. The flaw is reachable over the network and requires no authentication, meaning any anonymous user on the internet can trigger it. Successful exploitation allows an attacker to tamper with forum data and disrupt availability of the affected service. No fix version has been published yet; HarborGuard tracks the advisory and will surface a patched-image rebuild the moment upstream ships a remediated release.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The vulnerable endpoint is exposed over the network, so an attacker must be able to reach the WordPress installation via HTTP/HTTPS from any internet-connected location.

• AuthenticationNot required

  No account or session token is needed; the flaw is exploitable by an anonymous, unauthenticated request.

• Victim interactionNot required

  The attacker does not need to trick any user into taking an action; the exploit is executed entirely by the attacker.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and imposes no special conditions such as race conditions or specific memory layout requirements.

Blast Radius

• An attacker can modify forum content, settings, or user-controlled data without authorization, bypassing role and permission checks.
• An attacker can disrupt availability of the forum service, causing denial of service to legitimate users.
• Because integrity and availability are both rated High and confidentiality is unaffected, stored data is at risk of tampering or deletion but not direct read-based disclosure through this vector alone.