CVE-2025-0764

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-0764", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2025-01-27T23:25:42.982Z", "datePublished": "2025-02-28T07:03:46.135Z", "dateUpdated": "2026-04-08T17:06:06.576Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T17:06:06.576Z"}, "affected": [{"vendor": "tomdever", "product": "wpForo Forum", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "2.4.1", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The wpForo Forum plugin for WordPress is vulnerable to arbitrary file read due to insufficient input validation in the 'update' method of the 'Members' class in all versions up to, and including, 2.4.1. This makes it possible for authenticated attackers, with subscriber-level privileges or higher, to read arbitrary files on the server."}], "title": "wpForo Forum <= 2.4.1 - Authenticated (Subscriber+) Arbitrary File Read in update", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/8cd8ffcb-0a24-4e0a-a9f9-23501742715f?source=cve"}, {"url": "https://plugins.trac.wordpress.org/changeset/3245711/wpforo"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-20 Improper Input Validation", "cweId": "CWE-20", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "baseScore": 6.5, "baseSeverity": "MEDIUM"}}], "credits": [{"lang": "en", "type": "finder", "value": "Michael Mazzolini"}], "timeline": [{"time": "2025-01-27T00:00:00.000Z", "lang": "en", "value": "Vendor Notified"}, {"time": "2025-02-27T00:00:00.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-02-28T14:52:00.376264Z", "id": "CVE-2025-0764", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-02-28T14:52:27.378Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-0764", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-02-28T14:52:00.376264Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-02-28T14:52:21.114Z"}}], "cna": {"title": "wpForo Forum <= 2.4.1 - Authenticated (Subscriber+) Arbitrary File Read in update", "credits": [{"lang": "en", "type": "finder", "value": "Michael Mazzolini"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 6.5, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"}}], "affected": [{"vendor": "tomdever", "product": "wpForo Forum", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "2.4.1"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2025-01-27T00:00:00.000Z", "value": "Vendor Notified"}, {"lang": "en", "time": "2025-02-27T00:00:00.000Z", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/8cd8ffcb-0a24-4e0a-a9f9-23501742715f?source=cve"}, {"url": "https://plugins.trac.wordpress.org/changeset/3245711/wpforo"}], "descriptions": [{"lang": "en", "value": "The wpForo Forum plugin for WordPress is vulnerable to arbitrary file read due to insufficient input validation in the 'update' method of the 'Members' class in all versions up to, and including, 2.4.1. This makes it possible for authenticated attackers, with subscriber-level privileges or higher, to read arbitrary files on the server."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-20", "description": "CWE-20 Improper Input Validation"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T17:06:06.576Z"}}}, "cveMetadata": {"cveId": "CVE-2025-0764", "state": "PUBLISHED", "dateUpdated": "2026-04-08T17:06:06.576Z", "dateReserved": "2025-01-27T23:25:42.982Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2025-02-28T07:03:46.135Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "wpForo Forum", "vendor": "tomdever", "versions": [{"lessThanOrEqual": "2.4.1", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "security@wordfence.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:gvectors:wpforo_forum:*:*:*:*:*:wordpress:*:*", "matchCriteriaId": "0A8C5320-0C88-4BF0-B458-9CB0EC6057AC", "versionEndExcluding": "2.4.2", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The wpForo Forum plugin for WordPress is vulnerable to arbitrary file read due to insufficient input validation in the 'update' method of the 'Members' class in all versions up to, and including, 2.4.1. This makes it possible for authenticated attackers, with subscriber-level privileges or higher, to read arbitrary files on the server."}, {"lang": "es", "value": "El complemento wpForo Forum para WordPress es vulnerable a la lectura arbitraria de archivos debido a una validaci\u00f3n de entrada insuficiente en el m\u00e9todo 'update' de la clase 'Members' en todas las versiones hasta la 2.4.1 incluida. Esto hace posible que atacantes autenticados, con privilegios de nivel de suscriptor o superiores, lean archivos arbitrarios en el servidor."}], "id": "CVE-2025-0764", "lastModified": "2026-06-17T08:27:07.067", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 3.6, "source": "security@wordfence.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-0764", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2025-02-28T14:52:00.376264Z", "version": "2.0.3"}}]}, "published": "2025-02-28T07:15:33.863", "references": [{"source": "security@wordfence.com", "tags": ["Patch"], "url": "https://plugins.trac.wordpress.org/changeset/3245711/wpforo"}, {"source": "security@wordfence.com", "tags": ["Third Party Advisory"], "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/8cd8ffcb-0a24-4e0a-a9f9-23501742715f?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-20"}], "source": "security@wordfence.com", "type": "Secondary"}, {"description": [{"lang": "en", "value": "NVD-CWE-noinfo"}], "source": "nvd@nist.gov", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-28T03:33:32.179223+00:00", "value": {"mitigation_remediation": ["Upgrade the wpForo Forum plugin to the latest version to apply the fix for the arbitrary file read issue.", "Restrict subscriber users from accessing the Members update functionality or remove the subscriber role when it is not required for site operation.", "Configure the web server to deny direct file access outside the permitted WordPress directories, limiting the plugin\u2019s ability to read files from prohibited locations."], "summary": {"action": "Patch", "impact": "Arbitrary File Read"}, "threat_synthesis": {"affected_systems": "The vulnerability affects the wpForo Forum WordPress plugin, developed by TomDever, in all releases up to and including version 2.4.1. Site operators using these versions should verify the installed version and plan a timely upgrade.", "description_and_impact": "Insufficient input validation in the Members class update method allows authenticated users with subscriber-level privileges or higher to request arbitrary file paths and read the contents of any file on the server. The attacker could therefore access configuration files, logs, or other files that contain sensitive data; the potential exposure of credentials is inferred from the ability to read arbitrary files.", "risk_and_exploitability": "The CVSS base score of 6.5 indicates a medium severity vulnerability with a threat to confidentiality. The EPSS score of less than 1% shows that exploitation is currently unlikely, and the issue is not listed in the CISA KEV catalog. Because the flaw requires authentication, an attacker must compromise a subscriber account or create one, after which the plugin can be directed to read any file within the server\u2019s filesystem."}}}}, "created": "2026-04-28T03:45:20.279689+00:00", "updated": "2026-04-28T03:45:20.279702+00:00", "vendors": []}