Medium · 6.3 CVE-2022-40206 EUVD-2022-43506GHSA-vf5x-8r9f-vm4f

WordPress wpForo Forum plugin <= 2.0.5 - Insecure direct object references (IDOR) vulnerability

Published Nov 8, 2022 · Updated Apr 28, 2026 · Assigned by Patchstack

Vendor: gVectors Team Product: wpForo Forum (WordPress plugin) Category: Web / CMS

Description

Insecure direct object references (IDOR) vulnerability in the wpForo Forum plugin <= 2.0.5 on WordPress allows attackers with subscriber or higher user roles to mark any forum post as private/public.

Affected products

Vendor	Product	Affected	Fixed
gVectors Team	wpForo Forum (WordPress plugin)	<= 2.0.5 – ≤ 2.0.5	—

References

https://wordpress.org/plugins/wpforo/
https://patchstack.com/database/vulnerability/wpforo/wordpress-wpforo-forum-plugin-2-0-5-insecure-direct-object-references-idor-vulnerability?_s_id=cve