CVE-2023-47870 - CVE House
Back to Database
Status published High CVE-2023-47870

WordPress wpForo Forum Plugin <= 2.2.6 is vulnerable to Broken Access Control and Cross Site Request Forgery (CSRF)

Vulnerability Description

Cross-Site Request Forgery (CSRF), Missing Authorization vulnerability in gVectors Team wpForo Forum wpforo allows Cross Site Request Forgery, Accessing Functionality Not Properly Constrained by ACLs leading to forced all users log out.This issue affects wpForo Forum: from n/a through 2.2.6.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2023-47870

Credits & Attribution

The following person or organization is credited with identifying this vulnerability, as recorded in the NVD database:

  • Jesse McNeil (Patchstack Alliance)

References

More from gVectors Team

View All →
CVE-2024-43289
WordPress wpForo Forum plugin <= 2.3.4 - Unauthenticated Sensitive Data Exposure vulnerability
High 7.5
CVE-2024-43288
WordPress wpForo Forum plugin <= 2.3.4 - Insecure Direct Object References (IDOR) vulnerability
Medium 4.3
CVE-2024-35681
WordPress wpDiscuz plugin <= 7.6.18 - Cross Site Scripting (XSS) vulnerability
Medium 6.5
CVE-2023-51691
WordPress wpDiscuz Plugin <= 7.6.12 is vulnerable to Cross Site Scripting (XSS)
Medium 5.9
CVE-2023-49759
WordPress WooDiscuz – WooCommerce Comments Plugin <= 2.3.0 is vulnerable to Cross Site Request Forgery (CSRF)
Medium 5.4

Affected Vendor

gVectors Team

View all reports →

Affected Software

wpForo Forum
Vulnerable Versions:
Unknown

Timeline

Official Publish: November 30th, 2023
Last Modified: April 28th, 2026
Added to House: July 22nd, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:H

Weaknesses (CWE)

CWE-352 CWE-862

MITRE ATT&CK TTPs

T1566.002 Spearphishing Link
Initial Access
T1204.001 Malicious Link
Execution
T1098 Account Manipulation
Persistence
T1565.001 Stored Data Manipulation
Impact
T1190 Exploit Public-Facing Application
Initial Access
T1068 Exploitation for Privilege Escalation
Privilege Escalation
T1078 Valid Accounts
Persistence
T1531 Account Access Removal
Impact