CVE-2026-12698: wpForo Forum < 3.1.3 - Subscriber+ Account Status and Reputation Manipulation via Profile Update Mass Assignment
The wpForo Forum WordPress plugin before 3.1.3 does not restrict which profile fields a member may set when editing their own account, allowing users with a subscriber-level account to write administrator-controlled account-state and reputation fields on their own profile, including self-activating a pending or banned account and forging their forum reputation score.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
wpForo Forum WordPress pluginto a version that resolves this vulnerability.Fixed in 3.1.3
Event History
Frequently Asked Questions
What is the severity of CVE-2026-12698?
CVE-2026-12698 is rated with a risk severity of 54.
How do I fix CVE-2026-12698?
To fix CVE-2026-12698, update the wpForo Forum plugin to version 3.1.3 or later.
What can attackers do with CVE-2026-12698?
Attackers can manipulate their own account status and reputation by exploiting profile update mass assignment due to inadequate restrictions.
Who is affected by CVE-2026-12698?
Users with a subscriber-level account on wpForo Forum prior to version 3.1.3 are affected by CVE-2026-12698.
Is there a workaround for CVE-2026-12698?
Currently, there are no known workarounds for CVE-2026-12698 other than updating to a patched version.