LiveActive security incident?Get immediate response
CVE Record

CVE-2026-0910: wpForo Forum <= 2.4.13 - Authenticated (Subscriber+) PHP Object Injection

The wpForo Forum plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 2.4.13 via deserialization of untrusted input in the 'wpforo_display_array_data' function. This makes it possible for authenticated attackers, with Subscriber-level access and above, to inject a PHP Object. No known POP chain is present in the vulnerable software, which means this vulnerability has no impact unless another plugin or theme containing a POP chain is installed on the site. If a POP chain is present via an additional plugin or theme installed on the target system, it may allow the attacker to perform actions like delete arbitrary files, retrieve sensitive data, or execute code depending on the POP chain present.

HighCVSS 8.8Not KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysishigh

Security readout for executives and security teams

Plain-English summary

CVE-2026-0910 affects the wpForo Forum WordPress plugin through version 2.4.13. A logged-in user with Subscriber-level access or higher could trigger unsafe PHP object deserialization. The plugin alone reportedly lacks a known exploitation chain, so real impact depends on other installed plugins or themes. Sites allowing public registration have higher exposure.

Executive priority

Prioritize remediation for public-facing WordPress sites using wpForo, especially communities with open registration. The vulnerability is high severity, but practical impact depends on the site’s plugin/theme mix and attacker account access.

Technical view

The issue is CWE-502 PHP Object Injection in wpForo Forum’s wpforo_display_array_data function, caused by deserialization of untrusted input. CVSS is 8.8 high, with low privileges required and no user interaction. Wordfence notes no known POP chain in wpForo itself; impact requires a compatible POP chain from another installed component.

Likely exposure

WordPress sites running wpForo Forum version 2.4.13 or earlier are exposed, especially if untrusted users can create Subscriber accounts. Exposure is lower where account creation is tightly controlled, but still relevant for any site with many low-privilege users.

Exploitation context

No active exploitation is stated in the provided sources, and the CVE is not listed as KEV in the bundle. Exploitation requires authentication and likely depends on another plugin or theme providing a usable POP chain, which can change by site configuration.

Researcher notes

Focus validation on wpForo <=2.4.13 and the referenced debug.php change to 2.4.14. Do not assume code execution is universally reachable; the source explicitly states no known POP chain in wpForo itself. Evaluate site-specific plugin and theme composition.

Mitigation direction

  • Update wpForo Forum to version 2.4.14 or later if available.
  • If immediate updating is not possible, restrict new user registration.
  • Review and reduce unnecessary Subscriber-level accounts.
  • Remove unused WordPress plugins and themes to reduce POP-chain exposure.
  • Monitor vendor and Wordfence guidance for updated remediation details.

Validation and detection

  • Inventory WordPress sites using wpForo Forum.
  • Confirm installed wpForo Forum version is above 2.4.13.
  • Check whether public user registration is enabled.
  • Review low-privilege user accounts for suspicious or unnecessary access.
  • Assess installed plugins and themes for unnecessary deserialization risk.
Prepared
Confidence
high
Sources
5

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cwe · medium confidence lookup

CWE-502: Code execution behavior lookup

Code execution and unsafe deserialization weaknesses often justify reviewing execution behavior and process telemetry. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.

Open ATT&CK lookup
cve · low confidence lookup

CVE-2026-0910 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
High
CVSS
8.8 (3.1)
Known Exploited
No
Published

Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

1CVSS vectors
0Timeline events
0ADP providers
4Source links

CVSS vector scores

1 official score

We collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.

ScoreVersionSeverityVectorExploitImpactSource
8.8CVSS 3.1HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H2.85.9Primary CVE score

Vulnerability scoring details

Base CVSS 3.1 score

8.8High
CVSS 3.1 vector shape for CVE-2026-0910Attack VectorAttack ComplexityPrivileges RequiredUser InteractionScopeConfidentiality ImpactIntegrity ImpactAvailability Impact

Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack Vector
NetworkAdjacentLocalPhysical
Attack Complexity
LowHigh
Privileges Required
NoneLowHigh
User Interaction
NoneRequired
Scope
ChangedUnchanged
Confidentiality Impact
HighLowNone
Integrity Impact
HighLowNone
Availability Impact
HighLowNone

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
tomdeverwpForo Forum0unaffected
Weakness

CWE details

CWE-502

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.

CWE-502 · source CWE mapping

Deserialization of Untrusted Data

Deserialization of Untrusted Data represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.

Open CWE intelligenceSame-CWE CVEs