CVE-2026-3666 - Vulnerability Analysis

Overview

wpForo Forum plugin for WordPress <= 2.4.16 contains an arbitrary file deletion vulnerability caused by missing file name/path validation against path traversal sequences, letting authenticated attackers with subscriber access delete arbitrary files, exploit requires subscriber level access or higher.

Severity & Score

Impact

Authenticated attackers can delete arbitrary files on the server, potentially disrupting service or causing data loss.

Mitigation

Update to a version later than 2.4.16.

References

• https://plugins.trac.wordpress.org/changeset?old_path=wpforo/tags/2.4.16/classes/Posts.php&new_path=wpforo/tags/2.4.17/classes/Posts.php&old=3471614&new=3483044
• https://www.wordfence.com/threat-intel/vulnerabilities/id/f215e320-8563-4d25-9963-ed3664b4901d?source=cve

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner