{
 "id": "WPSEC-2026-2224",
 "url": "https://wpsec.com/vuln/WPSEC-2026-2224/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-2224/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-2224/index.md",
 "title": "wpForo Forum <= 3.2.2 - Unauthenticated Privilege Escalation via Secondary Usergroup Assignment",
 "description": "The wpForo Forum plugin for WordPress is vulnerable to Privilege Escalation via secondary usergroup assignment in all versions up to, and including, 3.2.2. The user_register handler accepted the 'wpforo_secondary_groupids' POST field on every signup route without checking that the requester was an administrator. The profile and registration form handler checked only a role blacklist rather than the groups the field offers, and it validated a comma-separated string value only by its first number while storing every group in the list, including the Administrator and Moderator groups. This makes it possible for unauthenticated attackers, when user registration is enabled, and for authenticated users with subscriber-level access and above, to add themselves to secondary usergroups they should not hold and gain the forum permissions those groups grant. Some configurations are required: either registration must be enabled, or the secondary usergroups field must be placed on the registration or account form.",
 "plugin": {
  "slug": "wpforo",
  "name": "wpForo Forum",
  "full_name": "wpForo Forum",
  "wordpress_org": "https://wordpress.org/plugins/wpforo/",
  "advisories_url": "https://wpsec.com/vuln/plugin/wpforo/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/wpforo"
 },
 "type": "PRIV",
 "cwe": [
  "CWE-269"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 6.5,
  "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:N",
  "severity": "Medium"
 },
 "affected": {
  "ranges": [
   {
    "from": null,
    "from_inclusive": true,
    "to": "3.2.3",
    "to_inclusive": false
   }
  ],
  "text": [
   "all versions before 3.2.3"
  ]
 },
 "introduced_in": null,
 "fixed_in": "3.2.3",
 "remediation": "Update to 3.2.3 or later.",
 "fix_released": "2026-11-01T15:03:11+00:00",
 "published": "2026-11-03T14:48:33+00:00",
 "updated": "2026-11-03T13:20:19.217988+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-2224/",
  "https://plugins.svn.wordpress.org/wpforo/tags/3.2.3/",
  "https://wordpress.org/plugins/wpforo/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/wpforo",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Medium",
  "affected_versions": "Medium",
  "as_of": "2026-11-03"
 }
}