CVE-2026-4666 is a missing authorization vulnerability in the wpForo Forum WordPress plugin (versions up to 2.4.16). The vulnerability arises from the use of extract($args, EXTR_OVERWRITE) on user-controlled input in the edit() method of classes/Posts.php. The post_edit action handler passes $_REQUEST['post'] directly to Posts::edit(), allowing an attacker to inject post[guestposting]=1 and bypass the permission check block. The nonce verification uses a hardcoded action shared across all forum templates, enabling any authenticated user who can view a forum page to obtain a valid nonce. This allows modification of post title, body, name, and email fields across all posts, including private and admin/moderator posts. Content filtering removes JavaScript but permits rich HTML.

Authenticated users with Subscriber-level privileges or higher can edit any forum post's content, including posts in private forums and those authored by administrators or moderators. This unauthorized modification can lead to content tampering and potential misinformation within the forum. The vulnerability does not affect confidentiality or availability but impacts integrity of forum data.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict user roles carefully and consider disabling the wpForo Forum plugin if unauthorized post modifications pose a significant risk. Monitor for updates from the vendor or trusted security sources.