CVE-2026-110004

Description

The wpForo Forum plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the theme_delete function in all versions up to, and including, 3.2.2 This makes it possible for authenticated attackers, with subscriber-level access and above, to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php). This exploit chain is reachable only on sites where an administrator has created a custom wpForo secondary usergroup with a blank WordPress role and the 'mth' (Manage Themes) capability; on such sites, an attacker can self-register and claim that group via the unguarded wpforo_secondary_groupids[] POST field, bypassing the role-based group filter and gaining theme-management access as a Subscriber.

Overview

State: PUBLISHED
Assigner (CNA): Wordfence
CVSS severity: MEDIUM
CVSS score: 6.5 / 10
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Effective score: 6.5 / 10 MEDIUM source: CNA overview
CWE(s): CWE-22
Reserved: 2026-10-13
Published: 2026-11-07 09:25 UTC
Last updated: 2026-11-07 09:25 UTC
Source: https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/110xxx/CVE-2026-110004.json

NVD triage scoring NVD CVE 2.0

Layer NVD adds on top of the CNA's CVE record — published / last-modified timestamps, exploitability / impact subscores, and the FIRST.org EPSS probability that this CVE will be exploited in the wild in the next 30 days.

NVD published: 2026-11-07 10:17:06 UTC
NVD last modified: 2026-11-07 10:17:06 UTC
NVD CVSS v3.1: 6.5 / 10 MEDIUM source: security@wordfence.com
NVD CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Exploitability subscore: 2.8 / 10
Impact subscore: 3.6 / 10
EPSS score: 0.0093 (probability of exploitation in next 30 days)
EPSS percentile: 60.78% vs all CVEs — higher = more likely to be exploited, as of 2026-11-07

European Union Vulnerability Database ENISA EUVD

ENISA's official EU repository for curated vulnerability intelligence. Carries a separate identifier (EUVD-YYYY-NNNN) and frequently exposes an earlier-published description + CVSS than NVD does.

EUVD ID: EUVD-2026-119031

EUVD enrichment is queued; refresh the page in a few seconds.

Affected products (1)

Vendor	Product	Versions	Platforms
tomdever	wpForo Forum	`0` (affected)	—

Vendor references (7)

References embedded in the original CVE record by the assigning CNA.

Web references (0)

DuckDuckGo results ranked by threat-intel / vendor advisory domains. Generated by the 🔎 Find references (web) button above — same flow as the Remediations search.

No web references attached yet.

NVD-tagged references (7)

Reference list NVD curates from the CNA record, vendor advisories, and third-party reports. The tag chips below are NVD's analyst-assigned categories.

https://plugins.trac.wordpress.org/browser/wpforo/tags/3.2.2/classes/Actions.php#L2405 security@wordfence.com
https://plugins.trac.wordpress.org/browser/wpforo/tags/3.2.2/classes/Actions.php#L2409 security@wordfence.com
https://plugins.trac.wordpress.org/browser/wpforo/tags/3.2.2/classes/Members.php#L1428 security@wordfence.com
https://plugins.trac.wordpress.org/browser/wpforo/tags/3.2.2/includes/functions.php#L1659 security@wordfence.com
https://plugins.trac.wordpress.org/changeset?reponame=&new=3778162%40wpforo%2Ftags%2F3.2.3&old=3717441%40wpforo%2Ftags%2F3.2.2 security@wordfence.com
https://wordpress.org/plugins/wpforo/#developers security@wordfence.com
https://www.wordfence.com/threat-intel/vulnerabilities/id/268f05d4-5f93-4d89-aa7f-c8731599dbc7?source=cve security@wordfence.com

Remediations (10)

CVE-2026-60004 Exploited: Patch Gitea Now

web:blog.gridinsoft.com

CISA set an August 28, 2026 remediation deadline for covered federal systems and lists ransomware use as unknown. That deadline is not a safe waiting period for other organizations: an internet-facing, vulnerable instance should be treated as an urgent patch -and-hunt case. How the Gitea Git-Hook RCE Works Gitea applied attacker-controlled patches inside a shared bare temporary clone. By ...

2026-11-08 11:46 UTC
SAP Security Patch Day - October 2026

web:support.sap.com

On 13 th of October 2026 , SAP security patch day saw the release of 16 new security notes and 4 GitHub security advisories. There are 2 updates to previously released security notes.

2026-11-08 11:46 UTC
CISA Flags Actively Exploited WordPress Core RCE Flaw, Patch to 7.1.4

web:thebackroomtech.com

The short answer to "am I at risk?" is this. If you run a self-hosted WordPress site that is not on the latest security release, treat this as an emergency patch , not routine maintenance. WordPress.org's 7.1.4 release notes list the fix as "a weakness in the WordPress upgrade process which can lead to remote code execution during the upgrade window" and say the security fixes are ...

2026-11-08 11:46 UTC
Emerging Threat: (CVE-2026-60004) Gitea Remote Code Execution via ...

web:www.cycognito.com

A Gitea host in that category is unlikely to appear in a patch cycle, which matters more for this CVE than for most, because remediation here is a version upgrade that someone has to know to perform. Are fixes available? Yes. Gitea 1.27.1 shipped on July 27, 2026 , and fixes the vulnerability.

2026-11-08 11:46 UTC
DSA-2026-467: Security Update for Dell OpenManage Enterprise ...

web:www.dell.com

Dell OpenManage Enterprise remediation is available for multiple security vulnerabilities that may be exploited by malicious users to compromise the affected system.

2026-11-08 11:46 UTC
The 8 Best Automated Vulnerability Remediation Tools in 2026

web:www.openhands.dev

Compare 8 automated vulnerability remediation tools for 2026 on fixes, prioritization, integrations, and deployment control.

2026-11-08 11:46 UTC
CVE-2026-110004: tomdever wpForo Forum: The wpForo Forum ... - Rapid7

web:www.rapid7.com

CVE-2026-110004 : tomdever wpForo Forum: The wpForo Forum plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation…. View severity, references, and remediation details from Rapid7.

2026-11-08 11:46 UTC
CISA Confirms Gitea CVE-2026-60004 Exploited: Cryptominer Hits 5,000 ...

web:www.techtimes.com

Gitea CVE - 2026 -60004, a CVSS 9.8 code-injection flaw, is now on CISA's Known Exploited Vulnerabilities list after attackers deployed cryptocurrency-mining malware on unpatched dev servers ...

2026-11-08 11:46 UTC
CVE-2026-110004 - Tenable

web:www.tenable.com

The wpForo Forum plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the theme_delete function in all versions up to, and including, 3.2.2 This makes it possible for authenticated attackers, with subscriber-level access and above, to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is ...

2026-11-08 11:46 UTC
CVE-2026-60004: Gitea Remote Code Execution (RCE) - PoC Available ...

web:www.thehackerwire.com

How do I fix or mitigate CVE - 2026 -60004? To protect against CVE - 2026 -60004, you should: (1) Apply the latest security patches from Gitea, (2) Check official security advisories for specific remediation steps, (3) Update affected software to the latest version, and (4) Monitor your systems for any signs of exploitation.

2026-11-08 11:46 UTC

AI Forensic Analysis

Only Available for Registered Users. Sign in to view.

Raw JSON

The full cvelistV5 record. Download as CVE-2026-110004.json.

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "wpForo Forum",
          "vendor": "tomdever",
          "versions": [
            {
              "lessThanOrEqual": "3.2.2",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "jiahao"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The wpForo Forum plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the theme_delete function in all versions up to, and including, 3.2.2 This makes it possible for authenticated attackers, with subscriber-level access and above, to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php). This exploit chain is reachable only on sites where an administrator has created a custom wpForo secondary usergroup with a blank WordPress role and the 'mth' (Manage Themes) capability; on such sites, an attacker can self-register and claim that group via the unguarded wpforo_secondary_groupids[] POST field, bypassing the role-based group filter and gaining theme-management access as a Subscriber."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-22",
              "description": "CWE-22 Improper Limitation of a Pathname to a Restricted Directory",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-07T09:25:45.421Z",
        "orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
        "shortName": "Wordfence"
      },
      "references": [
        {
          "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/268f05d4-5f93-4d89-aa7f-c8731599dbc7?source=cve"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/wpforo/tags/3.2.2/classes/Actions.php#L2409"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/wpforo/tags/3.2.2/classes/Actions.php#L2405"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/wpforo/tags/3.2.2/classes/Members.php#L1428"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/wpforo/tags/3.2.2/includes/functions.php#L1659"
        },
        {
          "url": "https://wordpress.org/plugins/wpforo/#developers"
        },
        {
          "url": "https://plugins.trac.wordpress.org/changeset?reponame=&new=3778162%40wpforo%2Ftags%2F3.2.3&old=3717441%40wpforo%2Ftags%2F3.2.2"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2026-10-08T20:06:20.000Z",
          "value": "Vendor Notified"
        },
        {
          "lang": "en",
          "time": "2026-11-06T20:57:52.000Z",
          "value": "Disclosed"
        }
      ],
      "title": "wpForo Forum <= 3.2.2 - Authenticated (Subscriber+) Arbitrary File Deletion via Path Traversal via 'theme' Parameter"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
    "assignerShortName": "Wordfence",
    "cveId": "CVE-2026-110004",
    "datePublished": "2026-11-07T09:25:45.421Z",
    "dateReserved": "2026-10-13T13:52:56.197Z",
    "dateUpdated": "2026-11-07T09:25:45.421Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}