CVE-2026-5809 is an Arbitrary File Deletion vulnerability in the wpForo Forum WordPress plugin (versions up to 3.0.2). The issue arises because the topic_add() and topic_edit() handlers accept arbitrary arrays from $_REQUEST and store them as postmeta without restricting which fields can contain arrays. The 'body' field allows an attacker to supply a file path via data[body][fileurl], which is stored in the database. Later, when the attacker triggers a delete action with wpftcf_delete[]=body, the plugin retrieves the stored file path and calls wp_delete_file() on it without proper validation or sanitization. This enables authenticated users with low privileges to delete arbitrary files writable by the PHP process, potentially impacting site availability and configuration.

An attacker with subscriber-level or higher access can delete arbitrary files on the server that are writable by the PHP process. This includes critical files such as wp-config.php, which could disrupt the WordPress site's operation or lead to denial of service. The vulnerability does not directly disclose information or allow code execution but impacts availability by file deletion.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict user roles and permissions to trusted users only, and consider disabling or limiting access to the wpForo Forum plugin's topic editing features for lower-privileged users. Monitor for updates from the vendor and apply patches promptly when available.