CVE-2026-49769: WordPress wpForo Forum plugin <= 3.1.0 - PHP Object Injection vulnerability

Synopsis

PHP Object Injection is an unauthenticated remote code execution class of vulnerability affecting the wpForo Forum WordPress plugin at version 3.1.0 and below. The flaw is reachable over the network with no credentials required and no user interaction needed, making it trivially exploitable from the open internet. Successful exploitation gives an attacker full control over confidentiality, integrity, and availability of the affected system. No upstream fix has been published yet; HarborGuard tracks this advisory and will make a patched-image rebuild available the moment a fix version is released.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The vulnerable service must be reachable over the network; any internet-exposed WordPress installation running the plugin is within the attacker's reach.

• AuthenticationNot required

  No account or session credentials of any kind are needed to trigger the injection.

• Victim interactionNot required

  The attacker makes no demands on any user; the exploit is fully server-side with no social-engineering step.

• Attack complexityDetail

  Exploit reliability is high and no special environmental conditions, race conditions, or memory layout assumptions are required.

Blast Radius

• An attacker can execute arbitrary PHP code on the server hosting the WordPress site, gaining full operating-system-level command execution.
• All data stored in the WordPress database, including user credentials, session tokens, private posts, and plugin configuration, is readable by the attacker.
• An attacker can write, modify, or delete files on the server, including WordPress core files, themes, and plugin files, corrupting site integrity.
• The attacker can crash or destabilize the web server process, taking the site fully offline and denying service to all visitors.