The wpForo Forum plugin for WordPress suffers from an arbitrary file deletion vulnerability due to two flaws: the Members::update() method does not properly validate or restrict file-type custom profile field values, enabling attackers to specify arbitrary file paths; and the wpforo_fix_upload_dir() function used in ucf_file_delete() inadequately sanitizes these paths before passing them to the unlink() function. Authenticated users with subscriber-level privileges or higher can exploit this to delete arbitrary files on the server, potentially leading to remote code execution. This issue requires the presence of the User Custom Fields addon plugin. The vulnerability has a CVSS 3.1 score of 8.1 (high severity). The product is cloud-hosted, and a patch is available.

An attacker with subscriber-level access or higher can delete arbitrary files on the server hosting the wpForo Forum plugin, which can lead to denial of service or remote code execution if critical files such as wp-config.php are deleted. This compromises the integrity and availability of the affected system. No known exploits are reported in the wild at this time.

Since the product is a cloud-hosted service, the vendor manages remediation server-side. A patch is available for this vulnerability. Users should ensure their wpForo Forum plugin and the User Custom Fields addon are updated to the fixed versions as provided by the vendor. Check the vendor advisory for confirmation and apply updates promptly.