Executive brief
The wpForo Forum plugin for WordPress, which adds community discussion features to websites, contains a security flaw that allows users to delete files from the web server. An attacker with a basic user account could exploit this to remove critical system files or website data, potentially leading to a complete site shutdown or loss of information. This issue affects all versions of the plugin up to 2.4.16.
Technical details
The wpForo Forum plugin for WordPress is vulnerable to arbitrary file deletion due to a path traversal vulnerability in the file handling logic within the Posts.php class. Authenticated attackers with subscriber-level permissions or higher can exploit this by embedding a crafted path traversal string (e.g., using ../ sequences) into a forum post body. When the attacker subsequently deletes the post, the plugin fails to validate the file path, causing it to delete the targeted file on the server instead of just the intended attachment or post data. This can lead to a denial of service or the removal of critical configuration files like wp-config.php. The issue is fixed in version 2.4.17.
Affected products
- tomdever wpForo Forum up to, and including, 2.4.16
Timeline
- 2026-04-04: disclosed
- 2026-04-04: advisory
- 2026-04-04: patched: Fixed in version 2.4.17