CVE-2026-49767: WordPress wpForo Forum plugin <= 3.1.0 - Broken Authentication vulnerability

Synopsis

An authentication bypass vulnerability exists in the wpForo Forum WordPress plugin at version 3.1.0 and earlier. The flaw is reachable over the network with no credentials required and no user interaction needed, meaning any external attacker who can reach the WordPress installation can exploit it. Successful exploitation gives the attacker full read, write, and availability impact over the affected system, enabling data theft, content manipulation, and service disruption. No fix version has been published yet; HarborGuard tracks the advisory and will make a patched-image rebuild available as soon as an upstream fix is released.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must be able to reach the WordPress service over the network; no local or physical access is assumed.

• AuthenticationNot required

  No credentials of any kind are needed; the vulnerability is fully unauthenticated.

• Victim interactionNot required

  No user action or social engineering is required; the attacker exploits the service directly.

• Attack complexityDetail

  Exploitation is reliable and condition-free, with no race conditions or special environmental factors required.

Blast Radius

• A successful attacker reads any data accessible to the WordPress application, including user credentials, session tokens, private posts, and personal information stored in the database.
• The attacker writes or modifies persisted database rows and site content, including creating rogue administrator accounts or altering forum posts and plugin configuration.
• The attacker can disrupt or crash the WordPress service, causing downtime for the affected site and its users.
• Because scope is unchanged, impact is contained to the vulnerable WordPress instance, but full compromise of that instance is achievable in a single unauthenticated request.