High severity · published Nov 30, 2023
CVE-2023-47870
WordPress wpForo Forum Plugin <= 2.2.6 is vulnerable to Broken Access Control and Cross Site Request Forgery (CSRF)
8.8
CVSS
0.3%
EPSS
No
On KEV
Description
Cross-Site Request Forgery (CSRF), Missing Authorization vulnerability in gVectors Team wpForo Forum wpforo allows Cross Site Request Forgery, Accessing Functionality Not Properly Constrained by ACLs leading to forced all users log out.This issue affects wpForo Forum: from n/a through 2.2.6.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 19% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
WF
wpForo Forum · gVectors Team
through 2.2.6 · source: vendor, NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2023-47870
CVE.org
https://www.cve.org/CVERecord?id=CVE-2023-47870
Third Party Advisory
https://patchstack.com/database/vulnerability/wpforo/wordpress-wpforo-plugin-2-2-3-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
More from wpForo Forum
9.8
CVE-2026-28562
wpForo Forum 2.4.14 SQL Injection via Topics ORDER BY Parameter
8.1
CVE-2024-43288
WordPress wpForo Forum plugin <= 2.3.4 - Insecure Direct Object References (IDOR) vulnerability
7.5
CVE-2024-43289
WordPress wpForo Forum plugin <= 2.3.4 - Unauthenticated Sensitive Data Exposure vulnerability
6.5
CVE-2026-28557
wpForo Forum < 2.4.16 Privilege Escalation via Role Synchronization Handler
6.1
CVE-2021-24406
wpForo Forum < 1.9.7 - Open Redirect