wpForo Forum Arbitrary File Deletion Vulnerability in WordPress

A vulnerability allowing arbitrary file deletion has been identified in the wpForo Forum plugin for WordPress, affecting versions through 3.0.5. This vulnerability arises from two main issues: first, the Members::update() method fails to properly validate file-type custom profile fields, enabling authenticated users to input arbitrary file paths instead of legitimate upload locations. Second, the wpforo_fix_upload_dir() function, used in ucf_file_delete(), only sanitizes paths that conform to a specific pattern, leaving room for exploitation. As a result, authenticated attackers with subscriber-level access or higher can delete arbitrary files from the server. This could lead to remote code execution if a critical file, such as wp-config.php, is removed.

Impact

Exploitation of this vulnerability allows authenticated users to delete arbitrary files on the server, which could lead to remote code execution if a sensitive file is targeted.

Remediation

Users are advised to update the wpForo Forum plugin to version 3.0.6 or a newer patched version.