CVE-2026-80513: wpForo Forum WordPress Plugin RCE Vulnerability

CVE-2026-80513 Overview

CVE-2026-80513 is a PHP Object Injection vulnerability in the wpForo Forum plugin for WordPress affecting versions before 3.1.6. The plugin deserializes user-supplied profile field values without restricting which classes may be instantiated [CWE-502]. Authenticated users with Subscriber-level access or higher can inject arbitrary PHP objects. The flaw is an incomplete fix of CVE-2026-49769. While the plugin itself contains no Property-Oriented Programming (POP) chain, a chain available in another installed plugin or theme could escalate the issue to remote code execution, arbitrary file operations, or SQL injection.

Critical Impact
Authenticated Subscriber accounts can inject PHP objects into deserialization, enabling potential RCE when a POP chain exists in the WordPress environment.

Affected Products

wpForo Forum WordPress plugin versions prior to 3.1.6
WordPress sites with Subscriber-level or higher registration enabled
Installations where additional plugins or themes contain exploitable POP chains

Discovery Timeline

2026-09-24 - CVE-2026-80513 published to NVD
2026-09-24 - Last updated in NVD database

Technical Details for CVE-2026-80513

Vulnerability Analysis

The wpForo Forum plugin processes user profile field values through PHP's unserialize() function without filtering the allowed_classes option. When a Subscriber-level user submits a crafted serialized payload in a profile field, PHP instantiates arbitrary classes present in the application's loaded codebase. This triggers magic methods such as __wakeup(), __destruct(), or __toString() on attacker-controlled objects.

The vulnerability is classified as Deserialization of Untrusted Data [CWE-502]. The plugin itself does not ship a usable POP chain. However, WordPress deployments typically load dozens of plugins and themes, and any one of them can supply the gadget chain required to turn object injection into code execution, file writes, or SQL injection.

This issue is an incomplete remediation of CVE-2026-49769, indicating that the previous patch did not fully restrict class instantiation during deserialization of profile data.

Root Cause

The root cause is unsafe deserialization of attacker-controlled input in profile field handling. The plugin calls unserialize() on data originating from authenticated user submissions without passing ['allowed_classes' => false] or using a safe format such as JSON.

Attack Vector

An attacker registers or authenticates as a Subscriber on a WordPress site running a vulnerable wpForo installation. The attacker then submits a serialized PHP object payload through a profile field. When the plugin deserializes the value, PHP reconstructs the attacker's object graph and invokes magic methods on the resulting instances. If a compatible gadget chain exists elsewhere in the WordPress stack, the attacker achieves code execution or data tampering under the web server's identity.

No verified exploit code is publicly available. Technical details are documented in the WPScan Vulnerability Report.

Detection Methods for CVE-2026-80513

Indicators of Compromise

Serialized PHP payloads in POST requests to wpForo profile endpoints, typically starting with O: followed by class name length and class name
Unexpected PHP process spawning web shells, outbound connections, or file writes under the WordPress user context
New or modified files in wp-content/uploads/ or plugin directories without a corresponding administrative action
Subscriber accounts registered shortly before anomalous profile update activity

Detection Strategies

Inspect web server logs for requests to wpForo profile update endpoints containing serialized object markers such as O: or a:
Monitor PHP error logs for __wakeup, __destruct, or class instantiation errors referencing unexpected class names
Correlate Subscriber account creation events with subsequent profile edits and file system changes

Monitoring Recommendations

Enable WordPress audit logging for user registration, role changes, and profile field updates
Alert on web shell indicators and unexpected PHP execution from wp-content directories
Review installed plugins and themes for known gadget chains that could be weaponized with this injection point

How to Mitigate CVE-2026-80513

Immediate Actions Required

Upgrade the wpForo Forum plugin to version 3.1.6 or later on all WordPress sites
Audit Subscriber-level accounts and remove unused or suspicious registrations
Review installed plugins and themes for deprecated or unmaintained code that may contain POP chains

Patch Information

The vendor addressed the issue in wpForo Forum version 3.1.6 by restricting the classes permitted during deserialization of profile field values. Administrators should apply the update through the WordPress plugin dashboard or by replacing the plugin files manually. Refer to the WPScan Vulnerability Report for advisory details.

Workarounds

Disable new user registration or restrict the Subscriber role until the plugin is updated
Deactivate the wpForo Forum plugin on sites that cannot be patched immediately
Place the WordPress site behind a web application firewall with rules that block serialized PHP payloads in profile field submissions

bash

# Example WordPress CLI commands to patch and verify
wp plugin update wpforo --version=3.1.6
wp plugin get wpforo --field=version
wp option update users_can_register 0