An arbitrary file deletion vulnerability in the wpForo Forum plugin allows authenticated subscribers to delete critical files, potentially leading to a complete service compromise.

This vulnerability arises from a two-step logic flaw in the topic_add and topic_edit action handlers, which fail to validate user-supplied file paths before passing them to the wp_delete_file function. Authenticated attackers with subscriber-level access or higher can manipulate these parameters to delete arbitrary files writable by the PHP process.

The ability to delete arbitrary files on the web server poses a significant risk to business continuity and data integrity. By targeting essential files like wp-config.php, an attacker can effectively take the website offline or force a re-installation, leading to severe downtime and potential data loss. With a CVSS score of 7.1, this is classified as a High severity issue requiring immediate remediation.

Immediate Action: Update the wpForo Forum plugin to the latest version available from the vendor repository that includes the security patch for the file deletion logic.

Proactive Monitoring: Review web server and application access logs for unusual requests directed at the topic_add or topic_edit endpoints, particularly those containing suspicious file path structures.

Compensating Controls: Implement a Web Application Firewall (WAF) rule to block requests that attempt to pass file paths or directory traversal patterns within the data[body][fileurl] parameter.

Public Exploit Available: Unknown

Given the potential for complete site failure through the deletion of core configuration files, administrators should prioritize updating the wpForo Forum plugin immediately. If an update is not currently feasible, consider restricting plugin access or disabling forum functionality until a patch can be applied to prevent unauthorized file manipulation.