CVE-2026-91092 Overview
CVE-2026-91092 is an authorization bypass vulnerability in the wpForo Forum plugin for WordPress, affecting all versions up to and including 3.1.5. The plugin fails to properly verify that a user is authorized to perform certain post-modification actions. Authenticated attackers with subscriber-level access or higher can take over another guest author's forum post. Successful exploitation lets the attacker modify the post title, body, author name, and stored owner email address. Exploitation requires that guest posting and editing are enabled on the forum, and that the attacker knows the target guest author's email address. The weakness is classified as Missing Authorization [CWE-862].
Critical Impact
Authenticated subscribers can hijack and alter guest-authored forum posts, tampering with content integrity and stored contact metadata.
Affected Products
- wpForo Forum plugin for WordPress, all versions up to and including 3.1.5
- WordPress sites with wpForo guest posting enabled
- WordPress sites with wpForo guest editing enabled
Discovery Timeline
- 2026-09-22 - CVE-2026-91092 published to the National Vulnerability Database (NVD)
- 2026-09-23 - Last updated in NVD database
Technical Details for CVE-2026-91092
Vulnerability Analysis
The wpForo plugin exposes an action path that updates guest-authored forum posts without confirming the requester owns the target post. Any authenticated user at subscriber level or above can invoke the action and pass the target guest author's email address as the identifier. The plugin treats knowledge of the email as sufficient proof of ownership, then permits the requester to overwrite fields on the underlying post record. Modifiable fields include the post title, body content, displayed author name, and the stored guest owner email. Because the attacker can rewrite the owner email, the original guest author can be locked out of any future edit workflow tied to that address. The impact is content tampering and metadata takeover rather than direct site compromise, but the altered posts remain public and attributed to the victim.
Root Cause
The root cause is a missing authorization check [CWE-862] in the guest post edit flow. The plugin verifies that the requester is authenticated but does not tie the request back to the user or session that originally created the guest post. Relevant logic resides in classes/Actions.php, classes/Posts.php, classes/Members.php, includes/functions.php, and includes/hooks.php within the 3.1.5 source tree.
Attack Vector
The vulnerability is exploitable over the network by an authenticated attacker holding subscriber privileges or higher. The attacker submits a crafted guest post edit request that references the victim's guest author email. The wpForo backend accepts the request and applies the attacker-supplied title, body, author name, and owner email. No user interaction from the victim is required. Exploitation is gated only by guest posting and editing being enabled and by the attacker learning a target email address, which forum posts frequently expose.
The vulnerability is described in prose rather than exploit code. See the WordPress wpForo Actions Class and WordPress wpForo Posts Class references for the affected code paths.
Detect Identity Attacks the Moment Authentication Fails
Singularity™ Identity surfaces credential misuse, lateral movement, and privilege escalation in real time, so you can contain the breach before it spreads.
Stop Identity AttacksDetection Methods for CVE-2026-91092
Indicators of Compromise
- Guest forum posts whose title, body, or displayed author changes without a corresponding legitimate edit request
- Guest post records where the stored owner email address changes to an address associated with a subscriber account
- Subscriber accounts issuing repeated wpForo edit action requests targeting posts they did not author
- Complaints from guest authors that they no longer receive edit notifications for their posts
Detection Strategies
- Audit the wpForo posts table for changes to email, title, body, and author-name columns and correlate with the acting WordPress user ID
- Inspect web server access logs for POST requests to wpForo action endpoints originating from low-privilege authenticated sessions
- Compare current post content against database backups to identify unauthorized rewrites of guest-authored posts
Monitoring Recommendations
- Enable WordPress audit logging for wpForo actions and forward events to a centralized log store for review
- Alert on any subscriber-role account that triggers guest post edits, especially where the owner email field is modified
- Monitor for creation of subscriber accounts followed shortly by wpForo edit activity against posts owned by other users
How to Mitigate CVE-2026-91092
Immediate Actions Required
- Update the wpForo Forum plugin to a version newer than 3.1.5 that includes the fix referenced in the vendor changeset
- If an update is not yet available for your environment, disable guest posting and guest editing in the wpForo settings
- Review subscriber-level accounts created recently and remove accounts that were used to trigger unauthorized edits
- Restore tampered guest posts and owner email addresses from a known-good backup
Patch Information
The vendor addressed the issue in a WordPress.org plugin repository commit tracked in the WordPress wpForo Changeset. Additional advisory context is available from the Wordfence Security Vulnerability entry.
Workarounds
- Disable guest posting in wpForo forum configuration until the plugin is updated
- Disable guest post editing so that the vulnerable code path cannot be reached
- Restrict new user registration or set the default WordPress role to a value that cannot access wpForo actions
- Mask or remove publicly displayed guest author email addresses to reduce the attacker's ability to identify targets
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
