CVE-2025-0764: wpForo Forum <= 2.4.1 - Authenticated (Subscriber+) Arbitrary File Read in update
The wpForo Forum plugin for WordPress is vulnerable to arbitrary file read due to insufficient input validation in the 'update' method of the 'Members' class in all versions up to, and including, 2.4.1. This makes it possible for authenticated attackers, with subscriber-level privileges or higher, to read arbitrary files on the server.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2025-0764?
CVE-2025-0764 is classified as a high severity vulnerability.
How do I fix CVE-2025-0764?
To fix CVE-2025-0764, update the wpForo Forum plugin to version 2.4.2 or later.
Who is affected by CVE-2025-0764?
CVE-2025-0764 affects all versions of the wpForo Forum plugin for WordPress up to and including 2.4.1.
What is the impact of CVE-2025-0764?
The impact of CVE-2025-0764 is that authenticated attackers can read arbitrary files on the server.
What methods were exploited in CVE-2025-0764?
CVE-2025-0764 exploits insufficient input validation in the 'update' method of the 'Members' class.