CVE-2026-4666 is a missing authorization vulnerability (CWE-862) in the wpForo Forum WordPress plugin up to version 2.4.16. The issue arises from the use of extract($args, EXTR_OVERWRITE) on user-controlled input in the edit() method of classes/Posts.php. The post_edit action handler passes $_REQUEST['post'] directly to Posts::edit(), enabling an attacker to inject post[guestposting]=1 and bypass the permission check block. The nonce verification uses a hardcoded action shared across all forum templates, allowing any authenticated user who can view a forum page to obtain a valid nonce. This flaw permits modification of post title, body, name, and email fields by users with Subscriber-level privileges or higher, including posts in private forums and those authored by admins or moderators. The plugin sanitizes content via wpforo_kses(), which removes JavaScript but permits rich HTML.

Authenticated users with Subscriber-level access or higher can bypass authorization controls to edit any forum post, including those in private forums and posts by administrators or moderators. This unauthorized modification can affect the integrity of forum content. The vulnerability does not impact confidentiality or availability but has a high impact on data integrity. No known exploits are reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch links are currently available. Until a patch is released, restrict user roles to trusted users only and monitor for suspicious post modifications. Avoid granting Subscriber-level access to untrusted users. Review forum permissions and consider disabling or limiting the wpForo Forum plugin if possible until remediation is available.