The wpForo Forum WordPress plugin versions prior to 3.1.3 suffer from improper access control (CWE-284) when users edit their own profiles. Specifically, subscriber-level users can write to profile fields that should be restricted to administrators, such as account state and reputation fields. This vulnerability allows unauthorized users to self-activate accounts that are pending or banned and to forge their reputation scores within the forum.

Exploitation of this vulnerability can lead to unauthorized privilege escalation in terms of account status and reputation manipulation. While it does not directly compromise confidentiality or availability, it undermines the integrity of user account states and reputation metrics, potentially allowing banned or pending users to regain access and manipulate trust scores.

No official patch or remediation guidance is currently available. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is released, administrators should monitor user account changes closely and consider restricting profile editing capabilities or applying custom access controls as a temporary mitigation.