CVE-2026-12697

The wpForo Forum WordPress plugin before 3.1.2 does not verify that an AI chat conversation belongs to the requesting user before deleting its messages, allowing users with a subscriber-level account to permanently delete the stored AI chat message history of any other user.

Score

CVSS 3.1 5.4 Medium

Status

Deferred - contact@wpscan.com

Published

2026-07-31

Last modified

2026-07-31

Weaknesses

CWE-639

Affected products

• Wpforo Forum (Unknown)

References

• https://wpscan.com/vulnerability/845362bb-a733-432e-86ac-7bf079d91e0f/