wpForo Forum < 3.1.2 – Subscriber+ Cross-User AI Chat Message Deletion via IDOR | CVE 2026-12697

Description

The plugin does not verify that an AI chat conversation belongs to the requesting user before deleting its messages, allowing users with a subscriber-level account to permanently delete the stored AI chat message history of any other user.

Proof of Concept

Prerequisites:
- The wpForo AI Chatbot feature is ENABLED BY DEFAULT (no admin configuration required); the default allowed groups include the "Registered" group, so any logged-in Subscriber-class member can use the chatbot endpoints.
- users_can_register=1 so the attacker can self-register a "Registered" (WP Subscriber) account.
- conversation_id is a global auto-increment value, enumerable across all users.

BASE="https://victim.example"

Step 1 (context) - A victim user has at least one AI chat conversation with message history (ordinary usage).

Step 2 - As the attacker (self-registered Subscriber-class "Registered" user), scrape your OWN nonce from the public forum page (it is localized into the page JS for any chat-eligible logged-in user):
curl -s -b attacker.cookies "$BASE/community/" | grep -oE 'wpforo_ai_chatbot\s*=\s*\{[^}]*"nonce":"[0-9a-f]+"'

Step 3 - As the attacker, delete the victim's conversation messages, iterating conversation_id:
curl -s -i -b attacker.cookies "$BASE/wp-admin/admin-ajax.php" \
  --data-urlencode 'action=wpforo_ai_chat_delete_conversation' \
  --data-urlencode 'nonce=<ATTACKER_NONCE>' \
  --data-urlencode 'conversation_id=<VICTIM_CONVERSATION_ID>'
# HTTP 200 {"success":true,"data":{"deleted":true}}

Result / verification (DB before/after):
- The victim's message rows for that conversation_id are permanently deleted (message COUNT drops to 0).
- The victim's conversation row SURVIVES (still owned by the victim, with a now-stale message_count), because the conversation-row delete IS ownership-scoped while the message-row delete is not.
- The attacker owns 0 conversations before and after; the destroyed rows were the victim's.

Honest negative (NOT exploitable):
- The attacker cannot READ the victim's messages (the read endpoints are ownership-scoped): destructive only, no disclosure (C:N).
- The victim's conversation row is not reassigned to the attacker.