What is CVE-2026-80514?

CVE-2026-80514 is a medium-severity vulnerability in Wpforo Forum, classified under CWE-348. CVSS score: 5.3/10. Published 2026-09-25.

How severe is CVE-2026-80514?

Medium severity. CVSS v3 base score is 5.3 out of 10.

Vulnerability in Wpforo Forum

CVE-2026-80514

The wpForo Forum WordPress plugin from 3.0.0 before 3.1.6 does not verify the source of client-supplied IP address headers before using them to key its per-visitor rate limit on paid AI requests, allowing unauthenticated attackers to bypass the limit by spoofing the header and exhaust the site owner's metered AI credits.

Published 2026-09-25 · last modified 2026-09-25.

CVSS v3 metric

CVSS v3 base score 5.3 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L.

EPSS exploit prediction

EPSS: 0.002 (4.4th percentile), scored 2026-09-26.

Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 4th percentile — 4.4% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.

The 30-day trend appears once there are two daily scores.

Affected products

Wpforo Forum

Weakness classification (CWE)

CWE-348

References

wpscan.com/vulnerability/1c08e9ba-b68a-4e77-970f-3dc7c7cd74f9/ (technical-description, exploit, vdb-entry)

Frequently asked questions

What is CVE-2026-80514?: CVE-2026-80514 is a medium-severity vulnerability in Wpforo Forum, classified under CWE-348. CVSS score: 5.3/10. Published 2026-09-25.
How severe is CVE-2026-80514?: Medium severity. CVSS v3 base score is 5.3 out of 10.