← Vulnerability feed

Vulnerability record · CVE-2022-40200 · published 17 November 2022

CVE-2022-40200: Gvectors wpforo forum unrestricted file upload vulnerability

Gvectors · Wpforo Forum

Auth. (subscriber+) Arbitrary File Upload vulnerability in wpForo Forum plugin <= 2.0.9 on WordPress.

8.8 CVSS 3.1 High EPSS 0.96% · top 39.9% CWE-434 · Unrestricted file upload
8.8CVSS 3.1 base score
0.96%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
4References
17 Jun 2026Last modified by NVD

Description

Auth. (subscriber+) Arbitrary File Upload vulnerability in wpForo Forum plugin <= 2.0.9 on WordPress.

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
https://patchstack.com/database/vulnerability/wpforo/wordpress-wpforo-forum-plugin-2-0-9-arbitrary-file-upload-vulnerabi Third Party Advisory
https://wordpress.org/plugins/wpforo/#developers ProductThird Party Advisory
https://patchstack.com/database/vulnerability/wpforo/wordpress-wpforo-forum-plugin-2-0-9-arbitrary-file-upload-vulnerabi Third Party Advisory
https://wordpress.org/plugins/wpforo/#developers ProductThird Party Advisory

Track CVE-2022-40200 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

9.8CVE-2023-47868Gvectors wpforo forum improper privilege management vulnerabilityImproper Privilege Management vulnerability in wpForo wpForo Forum allows Privilege Escalation.This issue affects wpForo Forum: from n/a through 2.2.…EPSS 0.48%9.8CVE-2018-16613Gvectors wpforo forum vulnerabilityAn issue was discovered in the update function in the wpForo Forum plugin before 1.5.2 for WordPress. A registered forum is able to escalate privileg…EPSS 2.7%8.8CVE-2026-28562Gvectors wpforo forum sql injection vulnerabilitywpForo 2.4.14 contains an unauthenticated SQL injection vulnerability in Topics::get_topics() where the ORDER BY clause relies on ineffective esc_sql…EPSS 0.50%8.8CVE-2023-47870Gvectors wpforo forum cross-site request forgery vulnerabilityCross-Site Request Forgery (CSRF), Missing Authorization vulnerability in gVectors Team wpForo Forum wpforo allows Cross Site Request Forgery, Access…EPSS 0.27%8.8CVE-2023-2249wpForo Forum plugin LFI, SSRF and PHAR deserialization via file_get_contentsThe wpForo Forum plugin for WordPress up to and including 2.1.7 passes attacker-controlled data to file_get_contents without proper verification, ena…EPSS 61%analysed8.8CVE-2022-40192Gvectors wpforo forum cross-site request forgery vulnerabilityCross-Site Request Forgery (CSRF) vulnerability in wpForo Forum plugin <= 2.0.9 on WordPress.EPSS 0.48%8.8CVE-2022-38144Gvectors wpforo forum cross-site request forgery vulnerabilityCross-Site Request Forgery (CSRF) vulnerability in gVectors Team wpForo Forum plugin <= 2.0.5 at WordPress.EPSS 0.51%8.1CVE-2024-43288Gvectors wpforo forum insecure direct object reference vulnerabilityAuthorization Bypass Through User-Controlled Key vulnerability in gVectors Team wpForo Forum.This issue affects wpForo Forum: from n/a through 2.3.4.EPSS 0.31%

Source: NIST National Vulnerability Database (record CVE-2022-40200), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.