wpForo Plugin Flaw Allows Arbitrary File Deletion, RCE

The National Vulnerability Database (NVD) has reported CVE-2026-6248, a high-severity arbitrary file deletion vulnerability in the wpForo Forum plugin for WordPress, affecting versions up to and including 3.0.5. This flaw stems from two critical issues: the Members::update() method fails to properly validate or restrict custom profile field values, allowing authenticated users to inject arbitrary file paths. Compounding this, the wpforo_fix_upload_dir() sanitization function, used in ucf_file_delete(), only re-maps paths matching an expected pattern and is directly passed to the unlink() function.

This dangerous combination means authenticated attackers with subscriber-level access or higher can delete arbitrary files on the server. The NVD highlights that deleting critical files, such as wp-config.php, can easily lead to full remote code execution. It’s crucial to note that exploiting this vulnerability requires the presence of a file custom field, which necessitates the wpForo - User Custom Fields addon plugin.

The CVSS score for CVE-2026-6248 is 8.1 (HIGH), with a vector of CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H. This indicates a network-exploitable vulnerability with low attack complexity and low privileges required, leading to high impact on integrity and availability. Defenders running wpForo Forum should consider this a critical threat.