The wpForo Forum plugin for WordPress contains an arbitrary file deletion vulnerability that allows authenticated attackers to delete critical system files, posing a high risk of remote code execution.

This vulnerability arises from improper path validation in the Members::update method and the wpforo_fix_upload_dir function, which allows authenticated users with subscriber-level access or higher to traverse directories and delete arbitrary files via the wpForo User Custom Fields addon.

Successful exploitation permits an attacker to delete sensitive configuration files such as wp-config.php, which can lead to service disruption or facilitate remote code execution if an attacker can force the application to reinstall or reset its state. With a CVSS score of 8.1, this vulnerability is classified as High severity because it provides a direct path to system compromise through file manipulation.

Immediate Action: Update the wpForo Forum plugin to the latest available version that includes the patch for this vulnerability.

Proactive Monitoring: Review web server logs for suspicious requests targeting the wpForo plugin endpoints and monitor for unauthorized deletions of sensitive configuration files.

Compensating Controls: Deploy a Web Application Firewall (WAF) to filter requests containing directory traversal sequences or unexpected file paths directed at plugin-specific upload handlers.

Public Exploit Available: No (exploit_available: false)

Given the potential for remote code execution and the high CVSS score of 8.1, organizations running the wpForo Forum plugin must prioritize updating to a patched version immediately. Administrators should verify the integrity of critical configuration files and ensure that user roles are restricted to prevent unauthorized access to the vulnerable custom field functionality.