CVE-2026-80513
High
Description
The wpForo Forum WordPress plugin before 3.1.6 does not restrict which classes may be instantiated when it deserializes a user-supplied profile field value, allowing authenticated users with Subscriber-level access and above to inject a PHP Object. No POP chain is present in the wpForo Forum WordPress plugin before 3.1.6 itself; if one is present via another installed wpForo Forum WordPress plugin before 3.1.6 or , this could lead to remote code execution, arbitrary file operations, or SQL injection. This is an incomplete fix of CVE-2026-49769.
SeverityHigh
CVSS7.5
Exploit probability—
ProductwpForo Forum
PublishedSep 24, 2026
First seenSep 24, 2026
Weakness typeCWE-502Deserialization of untrusted data
How to fix
Update
- wpForo Forum3.1.6 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| wpForo Forum | v < 3.1.6 | 3.1.6 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.