Executive brief
A vulnerability exists in the wpForo Forum plugin for WordPress, which is used to add community discussion boards to websites. An issue in the AI chatbot feature allows any registered user to permanently delete the chat history of other users. While attackers cannot read the private messages, they can cause data loss and disrupt the service for other community members.
Technical details
An Insecure Direct Object Reference (IDOR) vulnerability exists in the wpForo Forum plugin's AI chatbot component. The `wpforo_ai_chat_delete_conversation` AJAX action fails to perform an ownership check on the `conversation_id` parameter before executing the deletion of associated message rows. An authenticated attacker with Subscriber-level privileges can obtain a valid nonce from the forum's public pages and iterate through conversation IDs to delete the message history of other users. While the conversation metadata row remains, the actual message content is permanently removed from the database. This issue is fixed in version 3.1.2.
Affected products
- gVectors Team wpForo Forum < 3.1.2
Timeline
- 2026-07-16: disclosed: Publicly published by WPScan
- 2026-07-31: advisory: NVD published date