Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-119164— wpForo Forum <= 3.2.2 - Authenticated (Subscriber+) Privilege Escalation to 'data[secondary_groupids]' CSV Parameter

Quick assessment

Affected
tomdever wpForo Forum
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

WordPress 的 wpForo 论坛插件在所有 3.2.2 及更早版本中存在权限提升漏洞。该漏洞源于 POST 处理程序中的 参数。其根本原因是 文件中 函数内针对 的授权检查存在类型混淆缺陷：在调用 和 之前，先将标量 CSV 字符串（例如 ）通过 强制转换为数组，会导致生成空数组。这使得外层条件判断失效，原本应在 else 分支中移除该字段的逻辑被完全绕过。与此同时，下游的 / 函数能正确解析原始 CSV 字符串，并将攻击者提供的组 ID 持久化存储到 字段中。 因此，拥有订阅者（Subscriber）及

CVSS 7.5 · High
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-119164

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
wpForo Forum <= 3.2.2 - Authenticated (Subscriber+) Privilege Escalation to 'data[secondary_groupids]' CSV Parameter
Source: CVE Program / CVE List V5
Vulnerability Description
The wpForo Forum plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 3.2.2 via the `data[secondary_groupids]` parameter of the `wpforo_action_profile_update` POST handler. This is due to a type-confusion flaw in the secondary_groupids authorization guard within the `Members::update()` function in `classes/Members.php`, where casting a scalar CSV string (e.g. `"0,1"`) with `(array)` before `array_map('intval', …)` and `array_filter()` produces an empty array — causing the guard's outer conditional, and the else-branch that would otherwise strip the field from the update, to be bypassed entirely — while `encode()`/`decode()` downstream correctly explodes the original CSV and persists the attacker-supplied group IDs to `wp_wpforo_profiles.secondary_groupids`. This makes it possible for authenticated attackers, with Subscriber-level access and above, to escalate their forum privileges to wpForo Administrator by injecting the privileged Admin group ID, granting access to the Forum Accesses editor and the ability to rewrite forum-wide capability policies for all members and edit arbitrary content owned by other users. Exploitation requires the attacker to have at least 3 approved wpForo posts to satisfy the plugin's default `min_number_posts_to_edit_account` antispam gate, along with a valid wpforo nonce obtained from their own account profile form.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
特权管理不恰当
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
tomdever wpForo Forum 0 ~ 3.2.2 -

II. Public POCs for CVE-2026-119164

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-119164

请登录查看更多情报信息。

Vendor Pages for CVE-2026-119164 (1)

Other References for CVE-2026-119164 (6)

Same Patch Batch · tomdever · 2026-11-07 · 5 CVEs total

CVE-2026-95870 7.5 HIGH wpForo Forum <= 3.2.1 - Unauthenticated SQL Injection via 'data' Parameter
CVE-2026-119155 7.5 HIGH wpForo Forum <= 3.2.2 - Unauthenticated SQL Injection via 'href[locale]' Parameter
CVE-2026-110004 6.5 MEDIUM wpForo Forum <= 3.2.2 - Authenticated (Subscriber+) Arbitrary File Deletion via Path Trave
CVE-2026-120532 6.4 MEDIUM wpForo Forum <= 3.2.2 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Reply

IV. Related Vulnerabilities

Same product: wpForo Forum
Same vendor: tomdever
Same weakness: CWE-269