CVE-2026-3666 is a path traversal vulnerability in the wpForo Forum WordPress plugin that permits authenticated users with subscriber-level privileges or above to delete arbitrary files on the server. The issue arises from inadequate validation of file paths in forum post content, allowing crafted path traversal strings to bypass restrictions. This vulnerability affects all versions up to 2.4.16 and can be exploited by embedding malicious path traversal sequences in a forum post body and subsequently deleting that post, resulting in arbitrary file deletion on the server.

Successful exploitation allows an attacker with low-level authenticated access to delete any file on the server that the web server process has permission to remove. This can lead to denial of service, data loss, or further compromise of the system. The CVSS v3.1 base score is 8.8, reflecting high impact on confidentiality, integrity, and availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict subscriber-level user permissions where possible and monitor for suspicious activity related to forum post deletions. Avoid granting unnecessary write or delete permissions to low-privilege users.