Vulnerability · Published Aug 4, 2026 · Assigned by WPScan

CVE-2026-12698wpForo Forum < 3.1.3 - Subscriber+ Account Status and Reputation Manipulation via Profile Update Mass Assignment

Medium 4.3

In plain English

A medium-severity improper access control in wpForo Forum from Unknown. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 17% of all known vulnerabilities).

Severity (CVSS 3.1)4.3Medium

Exploit odds (30 days)0.3%top 82.9% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

The wpForo Forum WordPress plugin before 3.1.3 does not restrict which profile fields a member may set when editing their own account, allowing users with a subscriber-level account to write administrator-controlled account-state and reputation fields on their own profile, including self-activating a pending or banned account and forging their forum reputation score.

Affected products (as reported)

Vendor	Product	Versions
Unknown	wpForo Forum	0 – before 3.1.3

Weakness: CWE-284 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

References

https://wpscan.com/vulnerability/b90a74b5-1694-4afc-9232-95cf092e2c98/ exploit, vdb-entry, technical-description