CVE-2026-12697 — wpForo Forum < 3.1.2 - Subscriber+ Cross-User AI Chat Message Deletion via IDOR

CVE-2026-12697

wpForo Forum < 3.1.2 - Subscriber+ Cross-User AI Chat Message Deletion via IDOR PUBLISHED

Description (CNA)

The wpForo Forum WordPress plugin before 3.1.2 does not verify that an AI chat conversation belongs to the requesting user before deleting its messages, allowing users with a subscriber-level account to permanently delete the stored AI chat message history of any other user.

Affected (CNA)

Vendor / product	Versions
Unknown / wpForo Forum	affected 0 before 3.1.2

CWE

No CWE identifiers supplied.

References

https://wpscan.com/vulnerability/845362bb-a733-432e-86ac-7bf079d91e0f/

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.