Description
The wpForo Forum WordPress plugin before 3.1.2 does not verify that an AI chat conversation belongs to the requesting user before deleting its messages, allowing users with a subscriber-level account to permanently delete the stored AI chat message history of any other user.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| — | wpForo Forum | < 3.1.2 | 3.1.2 |
References
- https://wpscan.com/vulnerability/845362bb-a733-432e-86ac-7bf079d91e0f/ exploit vdb-entry technical-description