# CVE-2026-12698: WordPress wpForo Forum privilege escalation via profile field mass assignment

Source: https://junglewise.ai/threats/cve-2026-12698-wordpress-wpforo-forum-privilege-escalation-via-profile-field  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-04. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-12698 · Severity: medium · CVSS 4.3 · Published 2026-08-04

wpForo Forum is a popular WordPress plugin that adds discussion forum functionality to WordPress sites. A vulnerability in versions before 3.1.3 allows ordinary subscriber-level members to manipulate their own account status and reputation scores by injecting hidden administrator-controlled fields during profile updates. An attacker can self-activate a banned or pending account, forge reputation points, and confirm their email address without authorization—effectively bypassing account restrictions and reputation systems that moderators rely on.

## Quick answers

**Is CVE-2026-12698 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-12698 being exploited in the wild.

**How severe is CVE-2026-12698?** Medium severity, with a CVSS score of 4.3, published 4 August 2026.

**Which products and versions are affected?** wpForo wpForo Forum before 3.1.3.

**Is there a fix for CVE-2026-12698?** A patch was published on 2026-07-27: Fixed in version 3.1.3 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-12698 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-12698?** Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

This is a broken access control vulnerability (mass assignment / over-posting) in the wpForo profile update handler. The vulnerable component fails to whitelist which fields a member may modify when editing their own profile; instead, it accepts and persists any field passed in the POST request (member[status], member[custom_points], member[is_email_confirmed], etc.) without validation. The attack requires the attacker to hold a subscriber-level account and have at least 3 approved forum posts (default threshold), which is self-achievable through normal participation. The attacker then crafts a profile update request containing both legitimate fields and injected admin-controlled fields, using a valid CSRF nonce and same-origin Referer. No further privilege is needed—the injected values are written directly to the database. Notably, role-bearing fields (groupid, secondary_groupids) are separately guarded and cannot be escalated. The vulnerability was patched in version 3.1.3.

## Affected products

- wpForo wpForo Forum before 3.1.3

## Timeline

- 2026-07-27: disclosed: Publicly published on WPScan
- 2026-07-27: patched: Fixed in version 3.1.3
- 2026-08-04: advisory: Published to NVD

## References

- [https://wpscan.com/vulnerability/b90a74b5-1694-4afc-9232-95cf092e2c98/](https://wpscan.com/vulnerability/b90a74b5-1694-4afc-9232-95cf092e2c98/)