CVE-2026-80513

creationtimestamp| type| source ---|---|--- 2026-09-24 10:14:25+00:00| seen| https://bsky.app/profile/donwebmedia.bsky.social/post/3mwazinkwvn25...

CVE-2026-80513 wpForo Forum < 3.1.6 - Subscriber+ PHP Object Injection via Profile Fields

The wpForo Forum WordPress plugin before 3.1.6 does not restrict which classes may be instantiated when it deserializes a user-supplied profile field value, allowing authenticated users with Subscriber-level access and above to inject a PHP Object. No POP chain is present in the wpForo Forum...