CVE-2026-5809 is an Arbitrary File Deletion vulnerability in the wpForo Forum WordPress plugin (versions up to 3.0.2). The issue arises because the topic_add() and topic_edit() action handlers accept arbitrary user-supplied arrays from $_REQUEST without restricting which fields may contain array values. Specifically, the 'body' field can contain a 'fileurl' parameter with an arbitrary file path. This path is stored in the plugin's custom postmeta table. When a topic_edit request includes wpftcf_delete[]=body, the plugin retrieves the stored file path, passes it through a function that only rewrites legitimate upload paths but leaves others unchanged, and then deletes the file at that path. This allows authenticated users with low privileges to delete any file writable by the PHP process, including critical configuration files.

An attacker with subscriber-level or higher access can delete arbitrary files on the server that are writable by the PHP process. This can result in denial of service or disruption of the WordPress site by removing critical files such as wp-config.php. The vulnerability impacts availability (high impact) and has limited confidentiality impact. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict subscriber-level user permissions where possible and monitor for suspicious activity related to topic editing. Avoid granting unnecessary write permissions to critical files on the server to reduce potential impact.