wpForo Forum <= 3.2.2 - Unauthenticated Privilege Escalation via Secondary Usergroup Assignment
- ID
- WPSEC-2026-2224
- Plugin
- wpForo Forum (wpforo)
- Affected
- all versions before 3.2.3
- Remediation
- Update to 3.2.3 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:N
- Weakness
- CWE-269
- Usage
- Plugin Medium · Affected versions Medium among sites WPSec scans, 2026-11-03
- Attack surface
- wpForo Forum on WPSec AttackSurface
- Fix released
- Published
Description
The wpForo Forum plugin for WordPress is vulnerable to Privilege Escalation via secondary usergroup assignment in all versions up to, and including, 3.2.2. The user_register handler accepted the 'wpforo_secondary_groupids' POST field on every signup route without checking that the requester was an administrator. The profile and registration form handler checked only a role blacklist rather than the groups the field offers, and it validated a comma-separated string value only by its first number while storing every group in the list, including the Administrator and Moderator groups. This makes it possible for unauthenticated attackers, when user registration is enabled, and for authenticated users with subscriber-level access and above, to add themselves to secondary usergroups they should not hold and gain the forum permissions those groups grant. Some configurations are required: either registration must be enabled, or the secondary usergroups field must be placed on the registration or account form.
References
- https://wpsec.com/vuln/WPSEC-2026-2224/
- https://plugins.svn.wordpress.org/wpforo/tags/3.2.3/
- https://wordpress.org/plugins/wpforo/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS