CVE-2026-12698

wpForo Forum WordPress plugin prior to 3.1.3 allows self-modification of admin-controlled account-state and reputation fields by subscriber-level users due to insufficient restrictions on editable profile fields. Root cause: mass assignment of profile fields on account edit. Consequences: subscri...