CVE-2024-43288 MEDIUM

CVE-2024-43288: WordPress wpForo Forum plugin <= 2.3.4 - Insecure Direct Object References (IDOR) vulnerability

Vendor Gvectors Team

Product wpForo Forum

Weakness CWE-639 · IDOR

Published August 18, 2024

Last update April 28, 2026

View on NVD All CVEs

CVSS base score

4.3/10

Attack vector Network

Attack complexity Low

Privileges required Low

User interaction None

Confidentiality None

Integrity Low

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

What the vulnerability does

01Description

Authorization Bypass Through User-Controlled Key vulnerability in gVectors Team wpForo Forum.This issue affects wpForo Forum: from n/a through 2.3.4.

Explanation of Vulnerability in Simple Terms

02Summary

wpForo Forum versions up to 2.3.4 contain an authorization flaw that allows low-privileged users to modify forum content they should not have access to. The vulnerability requires an authenticated account but no user interaction from victims. Integrity of forum data can be compromised, though confidentiality and availability are not affected.

What an attacker can do

03Attacker Capabilities

Modify forum posts or settings that should be restricted to higher-privileged users.

Potential impact on your site

04Site Impact

Forum moderators or admins may find their posts or settings altered by regular members without authorization.

Conditions required to exploit

05Prerequisites

Attacker must have a low-privilege account on the forum (e.g., regular member).

Key dates

06Disclosure timeline

August 18, 2024 CVE published

April 28, 2026 Record updated

External resources

07References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2024-43288 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/639.html AskarLabs — CWE-639 write-up Authorization Bypass Through User-Controlled Key

Related vulnerabilities