WordPress Plugin Vulnerabilities

wpForo Forum < 2.3.5 - Authenticated (Subscriber+) Insecure Direct Object Reference

Description

The wpForo Forum plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 2.3.4 due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with Subscriber-level access and above, to perform an unauthorized action.

Affects Plugins

Plugin icon
wpforo
Fixed in 2.3.5

References

CVE
CVE-2024-43288
URL
https://www.wordfence.com/threat-intel/vulnerabilities/id/9cac5c66-d366-4a67-b29b-4efed67ab55b

Classification

Type
IDOR
OWASP top 10
A5: Broken Access Control
CWE
CWE-639
CVSS
4.3 (medium)

Miscellaneous

Original Researcher
Ananda Dhakal
Verified
No
WPVDB ID
6af78616-d9c7-4c04-9452-fa0acb67d6bc

Timeline

Publicly Published
2024-08-16 (about 1 year ago)
Added
2024-08-22 (about 1 year ago)
Last Updated
2024-08-22 (about 1 year ago)

Other

Published
Title
Published
2023-08-01
Title
Stripe Payment Plugin for WooCommerce < 3.7.8 - Authentication Bypass
Published
2024-11-20
Title
If-So Dynamic Content Personalization < 1.9.2.2 - Authenticated (Contributor+) Post Disclosure
Published
2026-04-20
Title
EventPrime – Events Calendar, Bookings and Tickets < 4.3.0.1 - Authenticated (Subscriber+) Insecure Direct Object Reference
Published
2026-03-12
Title
Formidable Forms < 6.29 - Unauthenticated Payment Amount Manipulation via 'item_meta' Parameter
Published
2025-09-03
Title
wpForo Forum < 2.4.7 - Authenticated (Subscriber+) Insecure Direct Object Reference