What is GHSA-7xp3-pmg2-gcq4?

GHSA-7xp3-pmg2-gcq4 is a security advisory published by GitHub Security Advisories with Medium severity. The wpForo Forum WordPress plugin from 3.0.0 before 3.1.6 does not verify the source of client...

Which CVE IDs does GHSA-7xp3-pmg2-gcq4 cover?

GHSA-7xp3-pmg2-gcq4 covers the following CVE IDs: CVE-2026-80514. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-7xp3-pmg2-gcq4?

GHSA-7xp3-pmg2-gcq4 has a CVSS v3 base score of 5.3, published by GitHub Security Advisories.

GHSA-7xp3-pmg2-gcq4MediumCVSS 5.3

The wpForo Forum WordPress plugin from 3.0.0 before 3.1.6 does not verify the source of client...

Vendor

GitHub Security Advisories

Published

September 25, 2026

Last Modified

September 25, 2026

🔗 CVE IDs covered (1)

CVE-2026-80514 →

📋 Description

The wpForo Forum WordPress plugin from 3.0.0 before 3.1.6 does not verify the source of client-supplied IP address headers before using them to key its per-visitor rate limit on paid AI requests, allowing unauthenticated attackers to bypass the limit by spoofing the header and exhaust the site owner's metered AI credits.

🔗 References (3)

https://nvd.nist.gov/vuln/detail/CVE-2026-80514
https://wpscan.com/vulnerability/1c08e9ba-b68a-4e77-970f-3dc7c7cd74f9
https://github.com/advisories/GHSA-7xp3-pmg2-gcq4