CVE-2026-12697CWE-639
CVE-2026-12697
Medium · published July 31, 2026
What it is
The wpForo Forum WordPress plugin before 3.1.2 does not verify that an AI chat conversation belongs to the requesting user before deleting its messages, allowing users with a subscriber-level account to permanently delete the stored AI chat message history of any other user.
The record
Technical detail
- CVSS v3.1
- 5.4 · MEDIUM
- Vector
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L
- CVSS v4.0
- Not supplied
- EPSS
- 0.00287 · 20.1th percentile
- Weakness
- CWE-639 · Authorization Bypass Through User-Controlled Key
- Published
- 2026-07-31T11:16Z
References (1)
EPSS history
Timeline