CVE-2026-80514

wpForo Forum 3.0.0 - 3.1.5 - Unauthenticated AI Credit Exhaustion via IP Rate Limit Bypass

The wpForo Forum WordPress plugin from 3.0.0 before 3.1.6 does not verify the source of client-supplied IP address headers before using them to key its per-visitor rate limit on paid AI requests, allowing unauthenticated attackers to bypass the limit by spoofing the header and exhaust the site owner's metered AI credits.

Affected

wpForo Forum

CVSS v3.1 WPSCAN

5.3 MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

EPSS

0.16% chance of exploitation in the next 30 days, 5th percentile

Published

2026-09-25

Proof-of-concept exploits (1)

• https://wpscan.com/vulnerability/1c08e9ba-b68a-4e77-970f-3dc7c7cd74f9/

References

• CVE Record
• NVD entry