CVE-2023-47870CWE-352CWE-862

WordPress wpForo Forum Plugin <= 2.2.6 is vulnerable to Broken Access Control and Cross Site Request Forgery (CSRF)

High · published November 30, 2023

CVSS v3.1
7.1
EPSS
0%
Percentile
17.8
In the wild
Unconfirmed
What it is

Cross-Site Request Forgery (CSRF), Missing Authorization vulnerability in gVectors Team wpForo Forum wpforo allows Cross Site Request Forgery, Accessing Functionality Not Properly Constrained by ACLs leading to forced all users log out.This issue affects wpForo Forum: from n/a through 2.2.6.

The record
Technical detail
CVSS v3.1
7.1 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:H
CVSS v4.0
Not supplied
EPSS
0.00267 · 17.8th percentile
Weaknesses
CWE-352 · Cross-Site Request Forgery (CSRF); CWE-862 · Missing Authorization
Published
2023-11-30T17:26Z
EPSS history
Timeline
  • 30 NOV 17:26Z
    WordPress wpForo Forum Plugin <= 2.2.6 is vulnerable to Broken Access Control and Cross Site Request Forgery (CSRF)
    cvelistv5