CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:H
What the vulnerability does
Cross-Site Request Forgery (CSRF), Missing Authorization vulnerability in gVectors Team wpForo Forum wpforo allows Cross Site Request Forgery, Accessing Functionality Not Properly Constrained by ACLs leading to forced all users log out.This issue affects wpForo Forum: from n/a through 2.2.6.
Explanation of Vulnerability in Simple Terms
wpForo Forum versions up to 2.2.6 contain a cross-site request forgery (CSRF) vulnerability that allows an attacker to perform actions on behalf of a logged-in user. An attacker can craft a malicious link or page that, when visited by a forum user, triggers unwanted actions such as deleting posts, modifying settings, or banning users. The vulnerability requires user interaction and affects only the availability of forum operations.
What an attacker can do
Trick a logged-in forum user into performing unwanted actions like deleting posts or changing forum settings.
Potential impact on your site
Forum users can be tricked into performing destructive actions without their knowledge, disrupting forum operations.
Conditions required to exploit
Attacker needs a logged-in forum user to visit a malicious link or page they control.
Key dates
External resources
Related vulnerabilities
