CVE-2025-67474

Root

Cause

The ForumWP plugin for WordPress, versions up to and including 2.1.0.0, contains a missing authorization vulnerability. This flaw allows an attacker to exploit incorrectly configured access control security levels, enabling unauthorized actions due to the lack of proper permission checks [1].

Attack

Vector

An attacker can exploit this vulnerability without needing any special privileges, as the access control checks are missing or improperly configured. The attack does not require any user interaction and can be performed remotely over the network, potentially affecting multiple sites at scale [1].

Impact

Successful exploitation could lead to unauthorized access and unauthorized actions, such as viewing or modifying forum settings, accessing restricted content, or performing other privileged operations depending on the plugin's capabilities. This can result in a compromise of the forum's integrity and confidentiality [1].

Mitigation

The vendor has released a patched version 2.1.5 which addresses the missing authorization. Users are strongly advised to update. Patchstack users can enable auto-update if available [1].