CVE-2023-2249

The wpForo Forum plugin for WordPress is vulnerable to Local File Include, Server-Side Request Forgery, and PHAR Deserialization in versions up to, and including, 2.1.7. This is due to the insecure use of file_get_contents without appropriate verification of the data being supplied to the function. This makes it possible for authenticated attackers, with minimal permissions such as a subscriber, to retrieve the contents of files like wp-config.php hosted on the system, perform a deserialization attack and possibly achieve remote code execution, and make requests to internal services.

• CWE-98
• CWE-829
• CWE-918

• https://plugins.trac.wordpress.org/browser/wpforo/tags/2.1.7/classes/Actions.php#L444Patch
• https://plugins.trac.wordpress.org/browser/wpforo/tags/2.1.8/classes/Actions.php#L437Patch
• https://www.wordfence.com/threat-intel/vulnerabilities/id/800fa098-b29f-4979-b7bd-b1186a4dafcb?source=cveThird Party Advisory
• https://plugins.trac.wordpress.org/browser/wpforo/tags/2.1.7/classes/Actions.php#L444Patch
• https://plugins.trac.wordpress.org/browser/wpforo/tags/2.1.8/classes/Actions.php#L437Patch
• https://www.wordfence.com/threat-intel/vulnerabilities/id/800fa098-b29f-4979-b7bd-b1186a4dafcb?source=cveThird Party Advisory

Published

Jun 9, 2023

Last Modified

Jun 17, 2026

Status

Modified

• One Click Account Takeover in GranolaHow a notification link broke out of Electron and led to a one-click account takeover.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2023-22484cmark-gfm is GitHub's fork of cmark, a CommonMark parsing an…7.5
• CVE-2023-22485cmark-gfm is GitHub's fork of cmark, a CommonMark parsing an…5.3
• CVE-2023-22486cmark-gfm is GitHub's fork of cmark, a CommonMark parsing an…7.5
• CVE-2023-22487Flarum is a forum software for building communities. Using t…4.3
• CVE-2023-22488Flarum is a forum software for building communities. Using t…5.4
• CVE-2023-22489Flarum is a discussion platform for websites. If the first p…3.5
• CVE-2023-22490Git is a revision control system. Using a specially-crafted …5.5
• CVE-2023-22491Gatsby is a free and open source framework based on React th…5.4
• CVE-2023-22492ZITADEL is a combination of Auth0 and Keycloak. RefreshToken…5.9
• CVE-2023-22493RSSHub is an open source RSS feed generator. RSSHub is vulne…7.5
• CVE-2023-22494Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2023-22495Izanami is a shared configuration service well-suited for mi…9.8