AdForest vulnerabilities

6 known vulnerabilities in AdForest from Scriptsbundle. 6 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 9.8 Critical severity

  AdForest: Missing Authentication for Critical Functionality

  CVE-2026-1729Feb 12, 2026Scriptsbundle

  The AdForest theme for WordPress is vulnerable to authentication bypass in all versions up to, and including, 6.0.12. This is due to the plugin not properly verifying a user's identity prior to authenticating them through the 'sb_login_user_with_otp_fun' funct

• 8.1 High severity

  AdForest: Improper Control of Filename for Include/Require Statement in PHP Program

  CVE-2025-67946Jan 22, 2026Scriptsbundle

  Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in scriptsbundle AdForest adforest allows PHP Local File Inclusion.This issue affects AdForest: from n/a through <= 6.0.11.

• 9.8 Critical severity

  AdForest: Authentication Bypass Using an Alternate Path or Channel

  CVE-2025-8359Sep 6, 2025Scriptsbundle

  The AdForest theme for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 6.0.9. This is due to the plugin not properly verifying a user's identity prior to authenticating them. This makes it possible for unauthenticated att

• 9.8 Critical severity

  AdForest: Missing Authentication for Critical Functionality

  CVE-2024-12857Jan 22, 2025Scriptsbundle

  The AdForest theme for WordPress is vulnerable to authentication bypass in all versions up to, and including, 5.1.8. This is due to the plugin not properly verifying a user's identity prior to logging them in as that user. This makes it possible for unauthenti

• 9.8 Critical severity

  AdForest: Weak Password Recovery Mechanism for Forgotten Password

  CVE-2024-11350Jan 8, 2025Scriptsbundle

  The AdForest theme for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 5.1.6. This is due to the plugin not properly validating a user's identity prior to updating their password through the adforest_r

• 9.8 Critical severity

  AdForest: Authentication Bypass Using an Alternate Path or Channel

  CVE-2024-11349Dec 21, 2024ScriptsbundleEPSS 1.22%

  The AdForest theme for WordPress is vulnerable to authentication bypass in all versions up to, and including, 5.1.6. This is due to the plugin not properly verifying a user's identity prior to authenticating them through the sb_login_user_with_otp_fun() functi