Vulnerability · Published Feb 28, 2026 · Assigned by VulnCheck

CVE-2026-28557wpForo Forum < 2.4.16 Privilege Escalation via Role Synchronization Handler

Medium 6.5

In plain English

A medium-severity missing authorization in wpForo Forum from gVectors Team. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 24% of all known vulnerabilities).

Severity (CVSS 3.1)6.5Medium

Exploit odds (30 days)0.3%top 75.9% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

wpForo Forum 2.4.14 contains a missing capability check vulnerability that allows authenticated users to trigger bulk wpForo usergroup reassignment via the wpforo_synch_roles AJAX handler. Attackers access the usergroups admin page, accessible to any authenticated user, to obtain a nonce, then remap all wpForo usergroups to arbitrary WordPress roles.

Affected products (as reported)

Vendor	Product	Versions
gVectors Team	wpForo Forum	2.4 – before 2.4.16

Weakness: CWE-862 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

References

wpForo Forum WordPress Plugin product
wpForo Forum Contributors & Developers patch
VulnCheck Advisory: wpForo Forum 2.4.14 Privilege Escalation via Role Synchronization Handler third-party-advisory