CVE-2023-2249 Server-side request forgery in wpForo Forum

High 8.8 Published 9 Jun 2023 Updated 8 Apr 2026

Authenticated attackers can exploit insecure file handling to read sensitive files, trigger deserialization for code execution, and perform server-side request forgery.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2023-2249?

CVE-2023-2249 is a high-severity server-side request forgery vulnerability in tomdever wpForo Forum, published on 9 Jun 2023. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

The wpForo Forum plugin for WordPress is vulnerable to Local File Include, Server-Side Request Forgery, and PHAR Deserialization in versions up to, and including, 2.1.7. This is due to the insecure use of file_get_contents without appropriate verification of the data being supplied to the function. This makes it possible for authenticated attackers, with minimal permissions such as a subscriber, to retrieve the contents of files like wp-config.php hosted on the system, perform a deserialization attack and possibly achieve remote code execution, and make requests to internal services.

Weakness: CWE-918, CWE-829, CWE-98

Which versions are affected by CVE-2023-2249?

It affects 1 product.

Products include Gvectors Wpforo Forum.

How do I fix CVE-2023-2249?

No fix has been published for CVE-2023-2249 yet. Limit exposure of the affected software until one is available.

Upgrade, and send outbound requests through an allow-list that blocks internal addresses. More about Server-side request forgery.

Is CVE-2023-2249 being exploited?

There is no known exploitation of CVE-2023-2249 in the wild and no public exploit code.

Sources

Also known as GHSA-9q86-473j-pphg.