← Vulnerability feed

Vulnerability record · CVE-2018-16613 · published 19 June 2019

CVE-2018-16613: Gvectors wpforo forum vulnerability

Gvectors · Wpforo Forum

An issue was discovered in the update function in the wpForo Forum plugin before 1.5.2 for WordPress. A registered forum is able to escalate privilege to the forum administrator without any form of user interaction.

9.8 CVSS 3.0 Critical EPSS 2.7% · top 14.5%
9.8CVSS 3.0 base score, v2 7.5
2.7%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
6References
17 Jun 2026Last modified by NVD

Description

An issue was discovered in the update function in the wpForo Forum plugin before 1.5.2 for WordPress. A registered forum is able to escalate privilege to the forum administrator without any form of user interaction.

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
https://github.com/9emin1/advisories Third Party Advisory
https://github.com/9emin1/advisories/blob/master/wpForo-1-5-1.md Third Party Advisory
https://wordpress.org/plugins/wpforo/#developers Release NotesVendor Advisory
https://github.com/9emin1/advisories Third Party Advisory
https://github.com/9emin1/advisories/blob/master/wpForo-1-5-1.md Third Party Advisory
https://wordpress.org/plugins/wpforo/#developers Release NotesVendor Advisory

Track CVE-2018-16613 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

9.8CVE-2023-47868Gvectors wpforo forum improper privilege management vulnerabilityImproper Privilege Management vulnerability in wpForo wpForo Forum allows Privilege Escalation.This issue affects wpForo Forum: from n/a through 2.2.…EPSS 0.48%8.8CVE-2026-28562Gvectors wpforo forum sql injection vulnerabilitywpForo 2.4.14 contains an unauthenticated SQL injection vulnerability in Topics::get_topics() where the ORDER BY clause relies on ineffective esc_sql…EPSS 0.50%8.8CVE-2023-47870Gvectors wpforo forum cross-site request forgery vulnerabilityCross-Site Request Forgery (CSRF), Missing Authorization vulnerability in gVectors Team wpForo Forum wpforo allows Cross Site Request Forgery, Access…EPSS 0.27%8.8CVE-2023-2249wpForo Forum plugin LFI, SSRF and PHAR deserialization via file_get_contentsThe wpForo Forum plugin for WordPress up to and including 2.1.7 passes attacker-controlled data to file_get_contents without proper verification, ena…EPSS 61%analysed8.8CVE-2022-40200Gvectors wpforo forum unrestricted file upload vulnerabilityAuth. (subscriber+) Arbitrary File Upload vulnerability in wpForo Forum plugin <= 2.0.9 on WordPress.EPSS 0.96%8.8CVE-2022-40192Gvectors wpforo forum cross-site request forgery vulnerabilityCross-Site Request Forgery (CSRF) vulnerability in wpForo Forum plugin <= 2.0.9 on WordPress.EPSS 0.48%8.8CVE-2022-38144Gvectors wpforo forum cross-site request forgery vulnerabilityCross-Site Request Forgery (CSRF) vulnerability in gVectors Team wpForo Forum plugin <= 2.0.5 at WordPress.EPSS 0.51%8.1CVE-2024-43288Gvectors wpforo forum insecure direct object reference vulnerabilityAuthorization Bypass Through User-Controlled Key vulnerability in gVectors Team wpForo Forum.This issue affects wpForo Forum: from n/a through 2.3.4.EPSS 0.31%

Source: NIST National Vulnerability Database (record CVE-2018-16613), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.