CVE-2026-12697: wpForo Forum < 3.1.2 - Subscriber+ Cross-User AI Chat Message Deletion via IDOR
Published Jul 31, 2026
·Updated
The wpForo Forum WordPress plugin before 3.1.2 does not verify that an AI chat conversation belongs to the requesting user before deleting its messages, allowing users with a subscriber-level account to permanently delete the stored AI chat message history of any other user.
Affected Software
1 affected component
wpForo Forum WordPress plugin<3.1.2
Event History
Jul 31, 2026
CVE Published
via MITRE·06:00 AM
Data Sourced
via MITRE·06:00 AM
DescriptionWeakness
Data Sourced
via NVD·07:16 AM
DescriptionSeverityWeakness
Frequently Asked Questions
1
What is the severity of CVE-2026-12697?
The severity of CVE-2026-12697 is rated at 43.
2
How do I fix CVE-2026-12697?
To fix CVE-2026-12697, update the wpForo Forum plugin to version 3.1.2 or later.
3
What type of vulnerability is CVE-2026-12697?
CVE-2026-12697 is an IDOR (Insecure Direct Object Reference) vulnerability affecting the wpForo Forum plugin.
4
Who is affected by CVE-2026-12697?
CVE-2026-12697 affects users with subscriber-level accounts on the wpForo Forum plugin before version 3.1.2.
5
What impact does CVE-2026-12697 have on users?
CVE-2026-12697 allows malicious users to delete the AI chat message history of other users, leading to potential data loss.