CVE-2026-80513 is a deserialization of untrusted data vulnerability (CWE-502) in the wpForo Forum WordPress plugin before version 3.1.6. The plugin does not restrict which classes may be instantiated during deserialization of user-supplied profile field values, enabling authenticated users with Subscriber-level access or higher to inject PHP objects. Although the plugin itself does not contain a gadget chain (POP chain) for exploitation, if such a chain exists in another installed plugin, this vulnerability could be leveraged to achieve remote code execution, arbitrary file operations, or SQL injection. This vulnerability represents an incomplete fix of CVE-2026-49769.

Authenticated users with Subscriber-level access or higher can inject PHP objects via deserialization, potentially leading to remote code execution, arbitrary file operations, or SQL injection if a suitable gadget chain is present in the environment. The vulnerability itself does not guarantee exploitation but can be combined with other vulnerable components to achieve significant impact.

Upgrade the wpForo Forum plugin to version 3.1.6 or later where this vulnerability is addressed. Since no official patch link is provided, verify the plugin version and update accordingly. Restricting plugin installations and minimizing user privileges can reduce risk. Patch status is considered fixed in 3.1.6 as implied by the affected version range.