medium5.4
CVE-2026-12697
The wpForo Forum WordPress plugin before 3.1.2 does not verify that an AI chat conversation belongs to the requesting user before deleting its messages, allowi…
Impact
The wpForo Forum WordPress plugin before 3.1.2 does not verify that an AI chat conversation belongs to the requesting user before deleting its messages, allowing users with a subscriber-level account to permanently delete the stored AI chat message history of any other user.
Affected products
| Product | Affected versions |
|---|---|
| WpForo Forum WordPress Plugin | before 3.1.2 |
Versions were read from the advisory text. No structured product data has been published for this record yet.