title: WordPress wpForo Forum plugin <= 2.0.5 - Insecure direct object references (IDOR) vulnerability
description: Insecure direct object references (IDOR) vulnerability in the wpForo Forum plugin <= 2.0.5 on WordPress allows attackers with subscriber or higher user roles to mark any forum post as private/public.
problem types: Insecure Direct Object References (IDOR)
affected:
{
vendor: gVectors Team
product: wpForo Forum (WordPress plugin)
versions:
version: <= 2.0.5, status: affected, lessThanOrEqual: 2.0.5, versionType: custom
}
metrics:
cvssV3_1: [
version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: LOW
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: LOW
integrityImpact: LOW
availabilityImpact: LOW
baseScore: 6.3
baseSeverity: MEDIUM
]
solutions: Update to 2.0.6 or higher version.