# CVE-2026-119164: wpForo Forum <= 3.2.2 - Authenticated (Subscriber+) Privilege Escalation to 'data[secondary_groupids]' CSV Parameter

Status: published. Published: 2026-11-07. Updated: 2026-11-07.

The wpForo Forum plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 3.2.2 via the `data[secondary_groupids]` parameter of the `wpforo_action_profile_update` POST handler. This is due to a type-confusion flaw in the secondary_groupids authorization guard within the `Members::update()` function in `classes/Members.php`, where casting a scalar CSV string (e.g. `"0,1"`) with `(array)` before `array_map('intval', …)` and `array_filter()` produces an empty array — causing the guard's outer conditional, and the else-branch that would otherwise strip the field from the update, to be bypassed entirely — while `encode()`/`decode()` downstream correctly explodes the original CSV and persists the attacker-supplied group IDs to `wp_wpforo_profiles.secondary_groupids`. This makes it possible for authenticated attackers, with Subscriber-level access and above, to escalate their forum privileges to wpForo Administrator by injecting the privileged Admin group ID, granting access to the Forum Accesses editor and the ability to rewrite forum-wide capability policies for all members and edit arbitrary content owned by other users. Exploitation requires the attacker to have at least 3 approved wpForo posts to satisfy the plugin's default `min_number_posts_to_edit_account` antispam gate, along with a valid wpforo nonce obtained from their own account profile form.

## Remediation

No remediation reported in collected sources

## Affected products and versions

- tomdever / wpForo Forum: ≥ 0; ≤ 3.2.2 (affected, semver). Source: CNA: Wordfence

## Severity and prioritization

- CVSS 3.1: 7.5 (high); CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H; source: CNA: Wordfence

- CVSS 3.1: 7.5 (high); CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H; source: NVD: security@wordfence.com

- CISA KEV: No listing in collected sources

- EPSS: Not available

- SSVC: Not available

- Weaknesses: CWE-269

## Exploit evidence

No exploit evidence in collected sources. This is not proof of no exploitation.

## References

- https://www.wordfence.com/threat-intel/vulnerabilities/id/8ef7232d-4acd-4db2-bfd0-d8e44bd59c19?source=cve (CNA: Wordfence)

- https://plugins.trac.wordpress.org/browser/wpforo/tags/3.2.2/classes/Members.php#L840 (CNA: Wordfence)

- https://plugins.trac.wordpress.org/browser/wpforo/tags/3.2.2/classes/Members.php#L1071 (CNA: Wordfence)

- https://plugins.trac.wordpress.org/browser/wpforo/tags/3.2.2/classes/Actions.php#L724 (CNA: Wordfence)

- https://plugins.trac.wordpress.org/browser/wpforo/tags/3.2.2/classes/Members.php#L731 (CNA: Wordfence)

- https://wordpress.org/plugins/wpforo/#developers (CNA: Wordfence)

- https://plugins.trac.wordpress.org/changeset?reponame=&new=3778162%40wpforo%2Ftags%2F3.2.3&old=3717441%40wpforo%2Ftags%2F3.2.2 (CNA: Wordfence)

- https://plugins.trac.wordpress.org/browser/wpforo/tags/3.2.2/classes/Actions.php#L724 (security@wordfence.com)

- https://plugins.trac.wordpress.org/browser/wpforo/tags/3.2.2/classes/Members.php#L1071 (security@wordfence.com)

- https://plugins.trac.wordpress.org/browser/wpforo/tags/3.2.2/classes/Members.php#L731 (security@wordfence.com)

- https://plugins.trac.wordpress.org/browser/wpforo/tags/3.2.2/classes/Members.php#L840 (security@wordfence.com)

- https://plugins.trac.wordpress.org/changeset?reponame=&new=3778162%40wpforo%2Ftags%2F3.2.3&old=3717441%40wpforo%2Ftags%2F3.2.2 (security@wordfence.com)

- https://wordpress.org/plugins/wpforo/#developers (security@wordfence.com)

- https://www.wordfence.com/threat-intel/vulnerabilities/id/8ef7232d-4acd-4db2-bfd0-d8e44bd59c19?source=cve (security@wordfence.com)

## Provenance

- CNA: Wordfence: https://www.cve.org/CVERecord?id=CVE-2026-119164; retrieved 2026-11-07; source updated 2026-11-07

- NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-119164; retrieved 2026-11-07; source updated 2026-11-07

Revision: 5c33ef59fdcace87fdcec2a15ae645753e77ea710c0251b43232fefff6b60474

Canonical: https://y2.dev/cve/CVE-2026-119164

## Agent and API access

Public CVE pages, Markdown, and JSON are free to read without an account or API key.

- Public catalog: https://y2.dev/cve/index.json. Follow nextCursor with the same search, filters, sort, and limit (1–100). A null cursor marks the end.

- WebMCP: search_cve_disclosures, get_cve_disclosure, get_cve_page_markdown, get_y2_cve_access. Available in compatible browsers.

- Cyber API: https://api.y2.dev/api/v2/cyber/cves and https://api.y2.dev/api/v2/cyber/cves/{cveId}.

- Y2 Pro or Elite: create a workspace API key with the intel:cyber scope and send Authorization: Bearer <Y2_API_KEY>. Setup: https://y2.dev/docs/api/create-key.

- x402: Pay per request without an account or API key. Omit Authorization, read the HTTP 402 PAYMENT-REQUIRED challenge, validate its current requirements, and retry with PAYMENT-SIGNATURE through an authorized payment client. These browser tools never make payments. Guide: https://y2.dev/docs/api/x402.

- OpenAPI: https://y2.dev/api/openapi.yaml. Agent access metadata: https://y2.dev/cve/agent.json.

Collected public records only. Check source status for coverage and freshness.