Arbitrary file deletion bug impacts wpForo Forum WordPress plugin

TL;DR — A two-step logic flaw in wpForo Forum lets authenticated (Subscriber+) attackers delete arbitrary files by persisting an attacker-controlled path and later triggering plugin-side deletion.

What happened

wpForo Forum is a WordPress forum plugin used to add discussion boards and community functionality to WordPress sites.

Wordfence published details for CVE-2026-5809 describing an arbitrary file deletion issue caused by a two-step logic flaw:

• The topic_add() / topic_edit() handlers accept arbitrary data[*] arrays from $_REQUEST and store them as postmeta without restricting which fields may contain array values.
• Because body is allowed, an attacker can supply data[body][fileurl] with an arbitrary file path (including wp-config.php or absolute server paths), which gets persisted.
• Later, the attacker submits wpftcf_delete[]=body on a topic_edit request, and the add_file() path retrieves the attacker-controlled fileurl and calls wp_delete_file() on it after a path rewrite helper that leaves non-wpForo paths unchanged.

This is the kind of bug that turns routine forum permissions (low-privilege accounts that can post/edit content) into a destructive server-side primitive. Persistent “store attacker input now, perform privileged filesystem action later” patterns also tend to survive superficial fixes, so teams should treat this as a structural risk in plugin-heavy WordPress deployments.

Who is impacted

• WordPress sites running the wpForo Forum plugin with versions <= 3.0.2.
• Sites that allow self-registration or otherwise have untrusted users with Subscriber+ access.
• Higher-risk deployments where the PHP process can write to sensitive files (or where deletion of files like wp-config.php can cause major outage/recovery workflows).

What to do now

• Follow vendor remediation guidance from Wordfence:

  "Remediation No known patch available. Please review the vulnerability's details in depth and employ mitigations based on your organization's risk tolerance. It may be best to uninstall the affected software and find a replacement."

• If you cannot remove it immediately, reduce exposure while you evaluate options:
  • Restrict who can create/edit topics (avoid granting Subscriber-level access to untrusted users; disable public registration if feasible).
  • Ensure WordPress/PHP filesystem permissions follow least privilege (limit what the web server user can delete).
  • Increase monitoring for wpforo topic add/edit activity and unexpected file deletions; keep offline backups ready for rapid restore.