CVE-2026-80513— wpForo Forum < 3.1.6 - Subscriber+ PHP Object Injection via Profile Fields
Quick assessment
Affected
Unknown wpForo Forum
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
在 wpForo Forum WordPress 插件 3.1.6 版本之前，当反序列化用户提供的个人资料字段值时，该插件未限制可实例化的类，从而导致具有订阅者（Subscriber）及更高级别访问权限的已认证用户能够注入 PHP 对象。 wpForo Forum WordPress 插件 3.1.6 之前的版本自身中不包含 POP（Property-Oriented Programming）链；但如果通过其他已安装的、版本低于 3.1.6 的 wpForo Forum 相关插件引入了此类链，则可能导致远程代码执行
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-80513
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
wpForo Forum < 3.1.6 - Subscriber+ PHP Object Injection via Profile Fields
Source: CVE Program / CVE List V5
Vulnerability Description
The wpForo Forum WordPress plugin before 3.1.6 does not restrict which classes may be instantiated when it deserializes a user-supplied profile field value, allowing authenticated users with Subscriber-level access and above to inject a PHP Object.
No POP chain is present in the wpForo Forum WordPress plugin before 3.1.6 itself; if one is present via another installed wpForo Forum WordPress plugin before 3.1.6 or , this could lead to remote code execution, arbitrary file operations, or SQL injection. This is an incomplete fix of CVE-2026-49769.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Unknown | wpForo Forum | 0 ~ 3.1.6 | - |
|
II. Public POCs for CVE-2026-80513
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-80513
请登录查看更多情报信息。
Other References for CVE-2026-80513 (1)
-
https://wpscan.com/vulnerability/09c9b9e7-c178-4f05-80d8-d4d77b7c5050/ exploit vdb-entry technical-description
Same Patch Batch · Unknown · 2026-09-24 · 16 CVEs total
| CVE-2026-93662 | Events Manager 7.4.1 - 7.4.4 - Subscriber+ Unpublished Event and Location Disclosure via ' | |
| CVE-2026-93661 | Events Manager < 7.4.5 - Contributor+ Arbitrary Ticket Overwrite via IDOR | |
| CVE-2026-88847 | MasterStudy LMS < 3.7.50 - Subscriber+ Lesson Completion Record Creation | |
| CVE-2026-89004 | WPeMatico RSS Feed Fetcher < 2.8.26 - Contributor+ Campaign Configuration and Log Disclosu | |
| CVE-2026-89005 | WPeMatico RSS Feed Fetcher < 2.8.26 - Contributor+ Stored XSS via Word to Category | |
| CVE-2026-89002 | WPeMatico RSS Feed Fetcher < 2.8.26 - Contributor+ Stored XSS via Campaign Item Preview | |
| CVE-2026-88843 | MasterStudy LMS 3.5.29 - < 3.7.50 - Contributor+ LFI via Elementor Courses Categories Widg | |
| CVE-2026-88846 | MasterStudy LMS 2.3.0 - < 3.7.50 - Unauthenticated Account Creation with Registration Disa | |
| CVE-2026-88845 | MasterStudy LMS 2.3.0 - < 3.7.50 - Subscriber+ Course and Lesson Creation via Demo Import | |
| CVE-2026-82195 | 10Web Booster < 2.34.0 - Unauthenticated Connection Secret Disclosure and Deletion | |
| CVE-2026-82850 | Masteriyo LMS < 3.4.2 - Subscriber+ Quiz Answer Key Disclosure | |
| CVE-2026-82849 | Masteriyo LMS < 3.4.2 - Subscriber+ Arbitrary User Course Progress Disclosure via IDOR | |
| CVE-2026-84151 | The Post Grid < 7.9.5 - Contributor+ Stored HTML/iframe Injection via wp_kses_post Allow-L | |
| CVE-2026-74991 | WPForms Lite 1.8.8.2 - 2.0.1.1 - Unauthenticated Stripe Refund and Subscription Cancellati | |
| CVE-2026-80338 | CMB2 < 2.13.0 - Subscriber+ Arbitrary Option Corruption via oEmbed Handler |
IV. Related Vulnerabilities
Same product: wpForo Forum
-
CVE-2026-80514
wpForo Forum 3.0.0 - 3.1.5 - Unauthenticated AI Credit Exhau -
CVE-2026-93747
wpForo Forum <= 3.1.6 - Authenticated (Subscriber+) Stored C -
CVE-2026-93772
WordPress wpForo Forum plugin <= 3.1.5 - Cross Site Scriptin -
CVE-2026-91092
wpForo Forum <= 3.1.5 - Missing Authorization to Authenticat -
CVE-2026-5097
wpForo Forum <= 2.4.17 - Unauthenticated SQL Injection via '
Same vendor: Unknown
-
CVE-2026-92996
Verge3D 4.1.0 - 4.13.0 - Unauthenticated Payment Bypass via -
CVE-2026-89411
Paymattic < 4.6.26 - Unauthenticated Payment Bypass via Unbo -
CVE-2026-86838
Bookly < 28.3 - Unauthenticated Payment Bypass via Booking P -
CVE-2026-88828
Blacklist Manager for WooCommerce 1.3.0 - 2.3.1 - Blocked Us -
CVE-2026-84744
WPForms Lite 1.5.0.1 - 2.0.2 - Unauthenticated Arbitrary Sho
V. Comments for CVE-2026-80513
No comments yet