CVE-2026-3666

The wpForo Forum plugin for WordPress is vulnerable to arbitrary file deletion in all versions up to, and including, 2.4.16. This is due to a missing file name/path validation against path traversal sequences. This makes it possible for authenticated attackers, with subscriber level access and above, to delete arbitrary files on the server by embedding a crafted path traversal string in a forum post body and then deleting the post.

• CWE-22

• https://plugins.trac.wordpress.org/changeset?old_path=wpforo/tags/2.4.16/classes/Posts.php&new_path=wpforo/tags/2.4.17/classes/Posts.php&old=3471614&new=3483044
• https://www.wordfence.com/threat-intel/vulnerabilities/id/f215e320-8563-4d25-9963-ed3664b4901d?source=cve

Published

Apr 4, 2026

Last Modified

Jul 24, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-36616Mercusys AC12G (EU) V1 with firmware AC12G(EU)_V1_200909 con…5.9
• CVE-2026-36618Mercusys AC12G (EU) V1 with firmware AC12G(EU)_V1_200909 res…4.3
• CVE-2026-3662A vulnerability has been found in Wavlink WL-NU516U1 240425.…7.2
• CVE-2026-3663A vulnerability was found in xlnt-community xlnt up to 1.6.1…7.1
• CVE-2026-3664A vulnerability was determined in xlnt-community xlnt up to …5.5
• CVE-2026-3665A vulnerability was identified in xlnt-community xlnt up to …5.5
• CVE-2026-36669An unauthenticated arbitrary file upload vulnerability in ck…9.8
• CVE-2026-3667A security flaw has been discovered in Freedom Factory dGEN1…5.3
• CVE-2026-36670A Time-Based Blind SQL Injection vulnerability in the alias_…8.8
• CVE-2026-3668A weakness has been identified in Freedom Factory dGEN1 up t…3.1
• CVE-2026-3669A security vulnerability has been detected in Freedom Factor…5.3
• CVE-2026-3670A vulnerability was detected in Freedom Factory dGEN1 up to …5.3