wpForo Forum Plugin Arbitrary File Deletion Vulnerability (CVE-2026-6248)

The wpForo Forum plugin for WordPress, specifically versions up to and including 3.0.5, contains an arbitrary file deletion vulnerability tracked as CVE-2026-6248. This vulnerability arises from two combined flaws in how the plugin handles file-type custom profile fields and sanitizes file paths. The Members::update() method lacks proper validation for file-type custom profile fields, enabling authenticated users to store arbitrary paths instead of legitimate upload paths. Furthermore, the wpforo_fix_upload_dir() sanitization function within ucf_file_delete() inadequately remaps paths, and the resulting path is directly passed to the unlink() function. Exploitation of this vulnerability requires the wpForo - User Custom Fields addon plugin. Successful exploitation can lead to remote code execution by deleting critical files, such as wp-config.php.

Attack Chain

1. An attacker with subscriber-level access or higher authenticates to the WordPress site with the wpForo plugin and the User Custom Fields addon enabled.
2. The attacker navigates to their profile settings.
3. The attacker identifies a file-type custom profile field.
4. Instead of uploading a legitimate file, the attacker enters an arbitrary file path on the server (e.g., /var/www/html/wp-config.php) into the custom field.
5. The attacker saves their profile, triggering the Members::update() method, which saves the arbitrary file path without proper validation.
6. The attacker then triggers the ucf_file_delete() function, potentially through a separate action such as deleting the profile picture or using a specific plugin feature designed to delete files.
7. The wpforo_fix_upload_dir() function attempts to sanitize the arbitrary path, but fails to properly remap it, allowing the arbitrary path to pass through.
8. The unlink() function is called with the attacker-supplied arbitrary path, resulting in the deletion of the targeted file. If the attacker targets wp-config.php, this can lead to remote code execution or site takeover.

Impact

Successful exploitation of CVE-2026-6248 allows an attacker with minimal privileges (subscriber-level) to delete arbitrary files on the WordPress server. This can lead to a denial of service, data loss, or, most critically, remote code execution if the attacker deletes essential files such as wp-config.php. The deletion of wp-config.php exposes database credentials and other sensitive information, allowing the attacker to take complete control of the WordPress site. The number of affected sites depends on the adoption rate of the wpForo plugin and its User Custom Fields addon.

Recommendation

• Upgrade the wpForo Forum plugin to a version greater than 3.0.5 to patch CVE-2026-6248.
• Deploy the Sigma rule wpforo_arbitrary_file_deletion to detect attempts to exploit this vulnerability by monitoring for suspicious HTTP requests with arbitrary file paths in custom field updates.
• Implement stricter input validation on file-type custom profile fields to prevent users from entering arbitrary file paths, addressing the root cause of the vulnerability.
• Review and harden the wpforo_fix_upload_dir() sanitization function to ensure it effectively prevents arbitrary file path traversal.
• Enable web server access logging and monitor for HTTP POST requests to wp-admin/admin-ajax.php with the action parameter set to 'wpforo_update_profile' and suspicious file paths within the request body, as indicated in the wpforo_profile_update Sigma rule.