CVE-2026-12698 is an improper access control vulnerability (CWE-284) in the wpForo Forum WordPress plugin prior to version 3.1.3. The vulnerability arises because the plugin does not restrict which profile fields a subscriber-level user can edit on their own account. As a result, attackers with low privileges can alter sensitive administrator-controlled fields such as account status and reputation, effectively bypassing intended restrictions and potentially elevating their privileges or manipulating forum trust metrics.

Users with subscriber-level access can escalate their privileges by self-activating accounts that are pending or banned and can falsify their reputation scores. This undermines the integrity of account management and reputation systems within the forum, potentially allowing unauthorized access and trust manipulation.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vulnerability affects versions before 3.1.3, upgrading to version 3.1.3 or later is recommended once confirmed by the vendor. Until an official fix is available, restrict subscriber account permissions where possible and monitor for suspicious profile modifications.