CVE-2026-80514: wpForo Forum 3.0.0 - 3.1.5 - Unauthenticated AI Credit Exhaustion via IP Rate Limit Bypass
The wpForo Forum WordPress plugin from 3.0.0 before 3.1.6 does not verify the source of client-supplied IP address headers before using them to key its per-visitor rate limit on paid AI requests, allowing unauthenticated attackers to bypass the limit by spoofing the header and exhaust the site owner's metered AI credits.
Affected Software
Event History
Frequently Asked Questions
Which installations are affected?
wpForo Forum versions 3.0.0 through 3.1.5 are affected. Version 3.1.6 is not listed as affected.
Does an attacker need an account or user interaction?
No. The issue is exploitable remotely without authentication or user interaction.
What must be enabled for this to have an impact?
The site must use wpForo's paid AI requests and have metered AI credits that can be consumed. The impact is exhaustion of those credits rather than disclosure or modification of data.
How is the rate limit bypassed?
The plugin uses client-supplied IP address headers as the key for its per-visitor limit without verifying their source. An attacker can spoof those headers to appear as different visitors and continue making AI requests.