CVE-2026-0910
Published: 11 February 2026
Summary
CVE-2026-0910 is a high-severity Deserialization of Untrusted Data (CWE-502) vulnerability in Wordpress (inferred from references). Its CVSS base score is 8.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 39.0th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Deeper analysis
CVE-2026-0910 is a PHP Object Injection vulnerability (CWE-502) in the wpForo Forum plugin for WordPress, affecting all versions up to and including 2.4.13. The issue arises from deserialization of untrusted input in the `wpforo_display_array_data` function, enabling authenticated attackers to inject a PHP Object. The vulnerability carries a CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
Authenticated attackers with Subscriber-level access or higher can exploit this vulnerability remotely over the network with low complexity. While no known Proof-of-Concept (POP) chain exists within the wpForo plugin itself, making it benign in isolation, the presence of a POP chain from another installed plugin or theme could allow severe impacts such as arbitrary file deletion, sensitive data retrieval, or remote code execution, depending on the chain.
Mitigation is addressed in version 2.4.14 of the wpForo plugin, as evidenced by code changes in the `admin/tools-tabs/debug.php` file between tags 2.4.13 and 2.4.14. Security practitioners should update to 2.4.14 or later and review co-installed plugins/themes for potential POP chains, per details in the Wordfence threat intelligence advisory.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-7072
Vulnerability details
The wpForo Forum plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 2.4.13 via deserialization of untrusted input in the 'wpforo_display_array_data' function. This makes it possible for authenticated attackers, with Subscriber-level access and…
more
above, to inject a PHP Object. No known POP chain is present in the vulnerable software, which means this vulnerability has no impact unless another plugin or theme containing a POP chain is installed on the site. If a POP chain is present via an additional plugin or theme installed on the target system, it may allow the attacker to perform actions like delete arbitrary files, retrieve sensitive data, or execute code depending on the POP chain present.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
PHP Object Injection vulnerability in a WordPress plugin (public-facing web application) exploitable remotely by low-privileged authenticated users, directly enabling exploitation of public-facing applications.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Timely flaw remediation requires updating the wpForo plugin to version 2.4.14 or later, which fixes the deserialization vulnerability in wpforo_display_array_data.
Information input validation enforces checks on untrusted data before deserialization, directly preventing PHP object injection via the vulnerable function.
Vulnerability monitoring and scanning identifies the presence of CVE-2026-0910 in wpForo and potential POP chains in co-installed plugins/themes, enabling proactive remediation.