Security readout for executives and security teams
Plain-English summary
A low-privilege WordPress account could upload arbitrary files through wpForo Forum version 2.0.9 or older. On affected sites, this can threaten site confidentiality, integrity, and availability. The issue is critical, especially for forums that allow public user registration.
Executive priority
Treat this as urgent for any public WordPress forum because a subscriber-level account may be enough to upload arbitrary files. Prioritize internet-facing sites and forums with open registration.
Technical view
CVE-2022-40200 is an authenticated subscriber-or-higher arbitrary file upload flaw in gVectors Team wpForo Forum for WordPress versions 2.0.9 and earlier. It is tracked as CWE-434 with CVSS 9.9: network exploitable, low complexity, no user interaction, and high impact across confidentiality, integrity, and availability.
Likely exposure
Exposure is limited to WordPress sites running wpForo Forum 2.0.9 or earlier. Risk rises when subscriber accounts are easy to obtain, such as public forum registration, weak account controls, or compromised low-privilege users.
Exploitation context
The source bundle does not show CISA KEV listing or cited evidence of active exploitation. The CVSS vector indicates exploitation requires authenticated low-privilege access, not administrator access, and no victim interaction.
Researcher notes
Evidence identifies the affected product and version range but does not provide exploit details, confirmed in-the-wild exploitation, or a named fixed version in the supplied bundle. Avoid assuming broader WordPress exposure beyond wpForo Forum 2.0.9 and earlier.
Mitigation direction
- Inventory all WordPress sites for wpForo Forum installations and versions.
- Update wpForo Forum to a vendor-supported version newer than the affected range.
- If immediate update is not possible, disable the plugin until vendor guidance is applied.
- Review forum registration policy and remove unnecessary low-privilege accounts.
- Check vendor and WordPress plugin pages for current remediation guidance.
Validation and detection
- Confirm no production site runs wpForo Forum version 2.0.9 or earlier.
- Verify public registration and subscriber access are intentionally enabled where needed.
- Review uploaded files and recent low-privilege account activity for anomalies.
- Confirm the plugin is updated, disabled, or removed on every WordPress instance.
- Monitor vendor advisories for any newly documented exploitation or fixes.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-434: File access and web shell behavior lookup
File traversal and upload weaknesses can lead teams to review file, web shell, execution, and collection telemetry. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupFile access behavior lookup
The CVE wording references file access or upload behavior, so file telemetry and web shell review may help. This is a Glexia inferred lookup path, not an official MITRE, ATT&CK, or CVE Program mapping.
Open ATT&CK lookupCVE-2022-40200 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Critical
- CVSS
- 9.9 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H3.16Primary CVE scoreVulnerability scoring details
Base CVSS 3.1 score
9.9CriticalVector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Source materials
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Unrestricted Upload of File with Dangerous Type
Unrestricted Upload of File with Dangerous Type represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.