CVE-2022-40205

MediumCVSS 4.3/10Last modified Jun 17, 2026

Description

Insecure direct object references (IDOR) vulnerability in the wpForo Forum plugin <= 2.0.5 on WordPress allows attackers with subscriber or higher user roles to mark any forum post as solved/unsolved.

Metrics

CVSS 3.1 4.3/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Weakness enumeration

CWE-639

Affected software

Vendor	Product	Versions
gVectors Team	wpForo Forum (WordPress plugin)	>= <= 2.0.5, <= 2.0.5

References

https://patchstack.com/database/vulnerability/wpforo/wordpress-wpforo-forum-plugin-2-0-5-insecure-direct-object-references-idor-vulnerability-2?_s_id=cveThird Party Advisory
https://wordpress.org/plugins/wpforo/Product, Release Notes, Third Party Advisory
https://patchstack.com/database/vulnerability/wpforo/wordpress-wpforo-forum-plugin-2-0-5-insecure-direct-object-references-idor-vulnerability-2?_s_id=cveThird Party Advisory
https://wordpress.org/plugins/wpforo/Product, Release Notes, Third Party Advisory

Timeline

Published: Nov 8, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-402064.3Insecure direct object references (IDOR) vulnerability in the wpForo Forum plugin <= 2.0.5 on WordPress allows attackers with subscriber or CVE-2022-402077.8Improper access control in the Intel(R) SUR software before version 2.4.8989 may allow an authenticated user to potentially enable escalatio CVE-2022-402084.3In Moodle, insufficient limitations in some quiz web services made it possible for students to bypass sequential navigation during a quiz at CVE-2022-402096.1Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Xylus Themes WP Smart Import plugin <= 1.0.2 on WordPress.CVE-2022-40214.3The Permalink Manager Lite plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.2.20.1. This CVE-2022-402107.8Exposure of data element to wrong session in the Intel DCM software before version 5.0.1 may allow an authenticated user to potentially enab CVE-2022-402114.8Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in GiveWP allows Stored XSS.This issue af CVE-2022-402135.4Multiple Authenticated (contributor+) Stored Cross-Site Scripting (XSS) vulnerabilities in GS Testimonial Slider plugin <= 1.9.6 at WordPres CVE-2022-402155.4Multiple Authenticated Stored Cross-Site Scripting (XSS) vulnerabilities in Tabs plugin <= 3.7.1 at WordPress.CVE-2022-402166.5Auth. (subscriber+) Messaging Block Bypass vulnerability in Better Messages plugin <= 1.9.10.69 on WordPress.CVE-2022-402177.2Authenticated (admin+) Arbitrary File Edit/Upload vulnerability in XplodedThemes WPide plugin <= 2.6 at WordPress.CVE-2022-402189.8Missing Authorization vulnerability in ThemeHunk Advance WordPress Search Plugin.This issue affects Advance WordPress Search Plugin: from n/