Read the docs
TI-2026-86489 Aliases CVE-2026-110004GHSA-phg4-5f9c-5j68

Path traversal in wpForo Forum lets subscribers delete files

Priority LOW 31CWE-22Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Information disclosure
Confidentiality · integrity · availability
High · None · None
Fix status
No fix listed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-22 and the CVSS impact.

Summary

The wpForo Forum plugin by tomdever for WordPress is affected up to and including 3.2.2. Insufficient file path validation in the theme_delete function allows path traversal (CWE-22). An authenticated attacker with Subscriber access or higher can delete arbitrary files on the server, which can lead to remote code execution, for example by deleting wp-config.php.

Written with Claude Haiku 5.5 from the sources below · 2026-11-07

Description from the CNA

The wpForo Forum plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the theme_delete function in all versions up to, and including, 3.2.2 This makes it possible for authenticated attackers, with subscriber-level access and above, to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php). This exploit chain is reachable only on sites where an administrator has created a custom wpForo secondary usergroup with a blank WordPress role and the 'mth' (Manage Themes) capability; on such sites, an attacker can self-register and claim that group via the unguarded wpforo_secondary_groupids[] POST field, bypassing the role-based group filter and gaining theme-management access as a Subscriber.

Why it matters now

EPSS 0.00929 60th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
gVectors TeamwpForo Forumup to 3.2.2—No fix listedCNA
  • wpForo Forum VendorgVectors Team Affected up to 3.2.2 Fixed in — No fix listed CNA

CPE names Threatist (inferred) · 1

Inferred from how NVD named this product before; not given by a source.

CPEVersionsRoleVendor
cpe:2.3:a:gvectors:wpforo_forum:*:*:*:*:*:*:*:*——gVectors Team
  • cpe:2.3:a:gvectors:wpforo_forum:*:*:*:*:*:*:*:* Versions — — ·gVectors Team

Remediation

The sources list no fixed version for wpForo Forum.

Written with Claude Haiku 5.5 from the sources below · 2026-11-07

Timeline

  1. 2026-11-07 Threatist record created from CVE-2026-110004
  2. 2026-11-07 Alias added: GHSA-phg4-5f9c-5j68
  3. 2026-11-08 Priority changed: MEDIUM → LOW

References

Other 7

  • TI-2020-14828 A Remote Code Execution vulnerability exists in the gVectors wpDiscuz plugin 7.0 through… CVSS 3.1CRITICAL 10.0
  • TI-2026-17809 Voltronic Power SNMP Web Pro 1.1 Path Traversal via upload.cgi CVSS 4.0HIGH 8.7
  • TI-2023-02108 Server-side request forgery in gVectors Team wpForo Forum CVSS 3.1HIGH 8.8
  • TI-2023-02165 wpForo Forum < 2.1.9 - Reflected Cross-Site Scripting CVSS 3.1MEDIUM 6.1
  • TI-2020-10702 A SQL injection issue in the gVectors wpDiscuz plugin 5.3.5 and earlier for WordPress… CVSS 3.1CRITICAL 9.8
  • TI-2026-36676 WordPress wpForo Forum plugin <= 3.1.0 - Broken Authentication vulnerability CVSS 3.1CRITICAL 9.8
See all 103 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences