Quick answers
- Is CVE-2026-3666 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-3666 being exploited in the wild.
- How severe is CVE-2026-3666?
- High severity, with a CVSS score of 8.8, published 4 April 2026.
- Which products and versions are affected?
- gVectors Team wpForo Forum up to, and including, 2.4.16.
- Is there a fix for CVE-2026-3666?
- A patch was published on 2026-04-04: Fixed in version 2.4.17 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-3666 attacked?
- It is attacked over the network, in a software library.
- Am I affected by CVE-2026-3666?
- Check whether you run gVectors Team wpForo Forum at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
The wpForo Forum plugin for WordPress is vulnerable to arbitrary file deletion due to a path traversal vulnerability in the file handling logic within the Posts.php class. Authenticated attackers with subscriber-level permissions or higher can exploit this by embedding a crafted path traversal string (e.g., using ../ sequences) into a forum post body. When the attacker subsequently deletes the post, the plugin fails to validate the file path, causing it to delete the targeted file on the server instead of just the intended attachment or post data. This can lead to a denial of service or the removal of critical configuration files like wp-config.php. The issue is fixed in version 2.4.17.
Affected products
- tomdever wpForo Forum up to, and including, 2.4.16
Timeline
- 2026-04-04: disclosed
- 2026-04-04: advisory
- 2026-04-04: patched: Fixed in version 2.4.17