Security Advisory

CVE-2026-12698

CVE vulnerability detail - eXtreme Datacenter Security Operations

Published 2026-08-04 06:00:09

Last updated 2026-08-04 14:29:45

Assigner WPScan

CVSS score not scored

State PUBLISHED

Description

The wpForo Forum WordPress plugin before 3.1.3 does not restrict which profile fields a member may set when editing their own account, allowing users with a subscriber-level account to write administrator-controlled account-state and reputation fields on their own profile, including self-activating a pending or banned account and forging their forum reputation score.

← Browse all CVEs View on cve.org ↗