CyberRota Analysis
AI-GeneratedThe wpForo Forum WordPress plugin prior to version 3.1.6 is vulnerable to deserialization issues, allowing authenticated users with Subscriber-level access or higher to instantiate arbitrary PHP objects. This flaw could lead to remote code execution, arbitrary file operations, or SQL injection if exploited in conjunction with other vulnerabilities. WordPress site administrators using affected versions should prioritize updating to version 3.1.6 or later to mitigate these risks.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
The wpForo Forum WordPress plugin before 3.1.6 does not restrict which classes may be instantiated when it deserializes a user-supplied profile field value, allowing authenticated users with Subscriber-level access and above to inject a PHP Object. No POP chain is present in the wpForo Forum WordPress plugin before 3.1.6 itself; if one is present via another installed wpForo Forum WordPress plugin before 3.1.6 or , this could lead to remote code execution, arbitrary file operations, or SQL injection. This is an incomplete fix of CVE-2026-49769.