CVE-2026-80514
MEDIUM
NVD
CVSS Score
5.3
Severity
MEDIUM
Published
Sep 25, 2026
Vendor
unknown
Description
The wpForo Forum WordPress plugin from 3.0.0 before 3.1.6 does not verify the source of client-supplied IP address headers before using them to key its per-visitor rate limit on paid AI requests, allowing unauthenticated attackers to bypass the limit by spoofing the header and exhaust the site owner's metered AI credits.