MEDIUM 4.3 NVD

CVE-2026-12698

The wpForo Forum WordPress plugin before 3.1.3 does not restrict which profile fields a member may set when editing their own account, allowing users with a sub

The wpForo Forum WordPress plugin before 3.1.3 does not restrict which profile fields a member may set when editing their own account, allowing users with a subscriber-level account to write administrator-controlled account-state and reputation fields on their own profile, including self-activating a pending or banned account and forging their forum reputation score.

References

https://wpscan.com/vulnerability/b90a74b5-1694-4afc-9232-95cf092e2c98/

Published: 2026-08-04 · Source: NVD · Feed updated: 2026-08-04

This medium severity vulnerability with a CVSS score of 4.3 was published on 2026-08-04 via NVD.

vulnfeed aggregates 9166 vulnerabilities from NVD, CISA KEV, Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.