CVE-2026-80513: wpForo Forum < 3.1.6 - Subscriber+ PHP Object Injection via Profile Fields
The wpForo Forum WordPress plugin before 3.1.6 does not restrict which classes may be instantiated when it deserializes a user-supplied profile field value, allowing authenticated users with Subscriber-level access and above to inject a PHP Object. No POP chain is present in the wpForo Forum WordPress plugin before 3.1.6 itself; if one is present via another installed wpForo Forum WordPress plugin before 3.1.6 or , this could lead to remote code execution, arbitrary file operations, or SQL injection. This is an incomplete fix of CVE-2026-49769.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
wpForo Forum WordPress pluginto a version that resolves this vulnerability.Fixed in 3.1.6
Event History
Frequently Asked Questions
Who would need to be able to access the site for exploitation to be possible?
An attacker must be authenticated and have at least Subscriber-level access. Unauthenticated exploitation is not described.
Does the affected plugin alone provide a path to remote code execution?
No POP chain is present in wpForo Forum itself before 3.1.6. More severe outcomes such as remote code execution, arbitrary file operations, or SQL injection depend on a usable POP chain being present through another installed component.
Which installations should be treated as affected?
Deployments using wpForo Forum versions earlier than 3.1.6 are affected. The issue is described as an incomplete fix for CVE-2026-49769.