CVE-2026-110004tomdever wpForo Forum path traversal

What it is

A file name from the request can climb out of the intended folder with sequences like ../, reaching files the service never meant to expose.

How it is reached

An attacker can exploit it over the network, with an ordinary user account, and nobody has to click anything.

What an attacker gains

A successful attack can read the data it protects. In practice, this kind of flaw lets an attacker read or write files outside the folders the service meant to expose.

Is it being exploited?

There is no public report of exploitation yet.

What to do

1. No fixed version is listed yet. Find every place tomdever wpForo Forum runs, watch the references for a fix, and plan a replacement if it is no longer supported.
2. While there is no fix, review who holds accounts that can reach it.

Description from NVD

The wpForo Forum plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the theme_delete function in all versions up to, and including, 3.2.2 This makes it possible for authenticated attackers, with subscriber-level access and above, to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php). This exploit chain is reachable only on sites where an administrator has created a custom wpForo secondary usergroup with a blank WordPress role and the 'mth' (Manage Themes) capability; on such sites, an attacker can self-register and claim that group via the unguarded wpforo_secondary_groupids[] POST field, bypassing the role-based group filter and gaining theme-management access as a Subscriber.