The wpForo Forum WordPress plugin versions prior to 3.1.2 contain an authorization bypass vulnerability (CWE-639) where the plugin fails to verify ownership of AI chat conversations before allowing deletion of their messages. This flaw permits users with subscriber-level privileges to permanently delete AI chat message histories belonging to other users, potentially causing data loss. The vulnerability has a CVSS 3.1 base score of 5.4 (medium severity) with network attack vector, low attack complexity, requiring low privileges, no user interaction, unchanged scope, no confidentiality impact, limited integrity impact, and limited availability impact.

An attacker with subscriber-level access can delete AI chat message histories of other users, leading to permanent loss of stored AI chat data. There is no confidentiality impact, but integrity and availability of the AI chat message data are affected.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or patch links are provided, users should monitor the vendor's announcements for updates. Until a fix is available, restricting subscriber-level permissions or disabling the affected AI chat message deletion functionality may reduce risk.