WordPress wpForo Forum Plugin <= 2.2.6 is vulnerable to Broken Access Control and Cross Site Request Forgery (CSRF)
Priority LOW 38CWE-352Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Tampering, Security bypass
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- No fix listed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-352 and CWE-862.
Summary
Cross-Site Request Forgery (CSRF), Missing Authorization vulnerability in gVectors Team wpForo Forum wpforo allows Cross Site Request Forgery, Accessing Functionality Not Properly Constrained by ACLs leading to forced all users log out.This issue affects wpForo Forum: from n/a through 2.2.6.
Why it matters now
EPSS 0.00267 18th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| gVectors Team | wpForo Forum | up to 2.2.6 | — | No fix listed | CNA |
- wpForo Forum VendorgVectors Team Affected up to 2.2.6 Fixed in — No fix listed CNA
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:gvectors:wpforo_forum:*:*:*:*:*:wordpress:*:* | up to 2.2.6 | Vulnerable | gVectors Team |
- cpe:2.3:a:gvectors:wpforo_forum:*:*:*:*:*:wordpress:*:* Versions up to 2.2.6 Vulnerable ·gVectors Team
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2023-47870
- 2026-10-03 Alias added: GHSA-whr2-w3q9-5g6m
References
More gVectors Team Wpforo Forum vulnerabilities
- TI-2023-02108 Server-side request forgery in gVectors Team wpForo Forum CVSS 3.1HIGH 8.8
- TI-2023-02165 wpForo Forum < 2.1.9 - Reflected Cross-Site Scripting CVSS 3.1MEDIUM 6.1
- TI-2023-25972 WordPress wpForo plugin <= 2.2.3 - Privilege Escalation vulnerability CVSS 3.1CRITICAL 9.8
- TI-2018-11904 An issue was discovered in the update function in the wpForo Forum plugin before 1.5.2… CVSS 3.0CRITICAL 9.8
- TI-2026-22817 wpForo Forum 2.4.14 SQL Injection via Topics ORDER BY Parameter CVSS 4.0HIGH 8.8
- TI-2022-19066 WordPress wpForo Forum plugin <= 2.0.9 - Auth. Arbitrary File Upload vulnerability CVSS 3.1CRITICAL 9.9
Sources
- CVE-2023-47870 · CVE Program
- CVE-2023-47870 · NVD
- FIRST EPSS
- GHSA-whr2-w3q9-5g6m · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences