Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
The wpForo Forum plugin for WordPress is vulnerable to Arbitrary File Deletion in versions up to and including 3.0.5. This is due to two compounding flaws: the Members::update() method does not validate or restrict the value of file-type custom profile fields, allowing authenticated users to store an arbitrary path instead of a legitimate upload path; and the wpforo_fix_upload_dir() sanitization function in ucf_file_delete() only remaps paths that match the expected pattern, and it is passed directly to the unlink() function. This makes it possible for authenticated attackers, with subscriber-level access and above, to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php). Note: The vulnerability requires a file custom field, which requires the wpForo - User Custom Fields addon plugin.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
NONE
Momentum
STABLE
| Date | Total | Labels |
|---|
| 2026-04-20 | 2 | Disclosure2 |
| 2026-04-21 | 1 | Disclosure1 |
| 2026-04-27 | 1 | General1 |
CVE-2026-6248: Tenda FH451 Stack Buffer Overflow - What It Means for Your Business and How to Respond https://hubs.li/Q04dyGbV0
Post summary
The content references CVE‑2026‑6248, a stack buffer overflow in the Tenda FH451, but provides no evidence of active exploitation, PoC, or patch information. It appears to focus on business implications and response guidance.
CVE-2026-6248 The wpForo Forum plugin for WordPress is vulnerable to Arbitrary File Deletion in versions up to and including 3.0.5. This is due to two compounding flaws: the Members:… https://www.cve.org/CVERecord?id=CVE-2026-6248
Post summary
The post announces CVE‑2026‑6248 as an arbitrary file deletion flaw in wpForo 3.0.5, but offers no exploit code, patch, or evidence of active exploitation.
CVE-2026-6248 Arbitrary File Deletion in wpForo Forum Plugin for WordPress Up to 3.0.5 https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-6248
Post summary
The text announces CVE-2026-6248, an arbitrary file deletion flaw affecting wpForo Forum Plugin versions up to 3.0.5, with details provided on a Vulmon vulnerability page.
⚠️ HIGH — CVE-2026-6248 The wpForo Forum plugin for WordPress is vulnerable to Arbitrary File Deletion in versions up to and including 3.0.5. T… CVSS 8.1 Full analysis → https://sec.kaitan.id/cves/CVE-2026-6248 #WordPress #CyberSecurity #InfoSec
Post summary
The post announces a high‑severity vulnerability (CVE‑2026‑6248) affecting wpForo, detailing the flaw as arbitrary file deletion but does not provide evidence of exploitation, PoC, or patch.