WordPress Plugin Vulnerabilities

wpForo Forum 3.0.0 - 3.1.5 - Unauthenticated AI Credit Exhaustion via IP Rate Limit Bypass

Description

The plugin does not verify the source of client-supplied IP address headers before using them to key its per-visitor rate limit on paid AI requests, allowing unauthenticated attackers to bypass the limit by spoofing the header and exhaust the site owner's metered AI credits.

Proof of Concept

Affects Plugins

Plugin icon
wpforo
Fixed in 3.1.6

References

CVE
CVE-2026-80514

Miscellaneous

Original Researcher
Usama Arshad
Submitter
Usama Arshad
Submitter website
https://www.usamaarshad.me/
Submitter twitter
usama0x01
Verified
Yes
WPVDB ID
1c08e9ba-b68a-4e77-970f-3dc7c7cd74f9

Timeline

Publicly Published
2026-09-22 (about 3 days ago)
Added
2026-09-22 (about 2 days ago)
Last Updated
2026-09-22 (about 2 days ago)

Other

Published
Title
Published
2026-09-17
Title
Payment Gateway for PayPal on WooCommerce < 9.2.1 - Unauthenticated Payment Bypass via Sandbox IPN Environment Confusion
Published
2026-08-14
Title
Charitable < 1.8.12 - Unauthenticated Donation Payment-Status Manipulation via Square Webhook Signature Bypass
Published
2026-09-14
Title
Really Simple Security < 9.8.2 - Subscriber+ Enforced 2FA Bypass via Grace Period Reset
Published
2026-07-07
Title
LatePoint < 5.4.1 - Unauthenticated Payment Bypass via Client-Supplied Stripe PaymentIntent ID
Published
2005-05-07
Title
WordPress <= 1.5.1.2 - Email Spoofing