The ForumWP – Forum & Discussion Board plugin for WordPress contains an authorization bypass vulnerability (CWE-639) due to missing validation on the 'user_id' parameter in the submit_form_handler function. Authenticated users with low-level privileges can manipulate this parameter to change the email address of admin users. This vulnerability enables privilege escalation by allowing attackers to reset admin passwords and take over admin accounts. The issue affects all versions up to and including 2.0.2. No official patch or remediation information is currently provided.

Successful exploitation allows an authenticated attacker with subscriber-level access or higher to escalate privileges to administrator by changing admin email addresses and resetting their passwords. This compromises the confidentiality, integrity, and availability of the affected WordPress site, potentially resulting in full site takeover.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict plugin usage to trusted users only and consider disabling or removing the ForumWP plugin if administrative access control is critical. Monitor for updates from the vendor and apply patches promptly once released.