CVE-2026-12697: Unknown Wpforo Forum

Medium severity, CVSS 5.4. EPSS: 0.3% chance of exploitation in the next 30 days.

The wpForo Forum WordPress plugin before 3.1.2 does not verify that an AI chat conversation belongs to the requesting user before deleting its messages, allowing users with a subscriber-level account to permanently delete the stored AI chat message history of any other user.

Affected products

• Unknown Wpforo Forum: before 3.1.2 (fixed in 3.1.2)

Published 2026-07-31. Last modified 2026-08-26.