wpForo Forum

IMPORTANT NOTES for UPDATE

• After the update, please delete all caches and purge CDN if you have
• After the update, please flush Redis Object Cache if you have this cache enabled

wpForo Forum 2.4.16 – Last 2.x Version | 28.02.2026

Next wpForo Release – v3.0 Beta Release Summary

• New: Admin notice announcing wpForo 3.0 AI Edition with links to introduction and beta program
• New: Auto-update protection — blocks automatic updates from 2.x to 3.x to prevent unattended major upgrades
• New: Inline warning on Plugins page when wpForo 3.0 update is available
• New: Auto-update toggle replaced with backup reminder when major version is pending
• Security: Added permission checks for post approve/unapprove actions
• Security: Added permission checks for topic close/open actions
• Security: Added permission checks for topic move, merge, and split actions
• Security: Added capability check for role synchronization
• Security: Fixed RSS feed exposing private and unapproved content
• Security: Fixed stored XSS via forum description output
• Security: Blocked SVG file uploads in avatar to prevent XSS
• Security: Replaced json_encode with wp_json_encode to prevent script injection

wpForo Forum 2.4.0 – 2.4.15 | 10.02.2026

wpForo Forum v2.4 Release Summary

• Version 2.4.15
• Security: Vulnerability – Unauthenticated Time-Based SQL Injection
• ———
• Version 2.4.14
• Security: Vulnerability – Authenticated (Subscriber+) PHP Object Injection
• ———
• Version 2.4.13
• Security: Vulnerability – Unauthenticated SQL Injection
• ———
• Version 2.4.12
• Compatibility: PHP 8.5
• Compatibility: WordPress 6.9
• Security: Vulnerability – Unauthenticated SQL Injection
• Fixed: Multi-language integration issues with Polylang
• ———
• Version 2.4.11
• Security: Vulnerability – Unauthenticated Attacker to Post Revisions
• ———
• Version 2.4.10
• Security: Vulnerability Authenticated (Susbscriber+) SQL Injection
• Fixed Bug: PHP Error: array_filter(): Argument #1 ($array) must be of type array, string given in classes/Members.php:2032
• ———
• Version 2.4.9
• Security: Unauthenticated SQL Injection
• Security: Object unserialize code injection
• ———
• Version 2.4.8
• Added: New option in widgets to sort topics/posts randomly
• Fixed Bug: Post editor text/object alignment issue
• ———
• Version 2.4.7
• Removed: Unnecessary profile buttons of guest posters
• Removed: HTML tags from category description
• Security: Fixed IDOR vulnerability, Insecure Direct Object References
• Addon Support: The rich editor is modified to allow aligning (left,right,center) gif and inline attachment objects
• Addon Support: Supports displaying voters on poll result
• Fixed Bug: PHP Error on the activation process of a user registration. Fatal error: Uncaught TypeError: array_intersect(): Argument #1 ($array) must be of type array, null given in /wp-content/plugins/wpforo/includes/hooks.php:37
• Fixed Bug: Missing user information in the admin email when user deletes own account
• ———
• Version 2.4.6
• Security: Fixed XSS vulnerability, Stored Cross-Site Scripting
• Updated: Hooks to manage the email sending test and error report in the tools
• Fixed Bug: Text domain loading issue
• Fixed Bug: Link RSS Module and RSS Settings to disable if the module is disabled
• Fixed Bug: PHP Warning: Undefined array key max-number-value when wpForo is integrated with Profile Builder plugin.
• ———
• Version 2.4.5
• Fixed Bug: Q&A forum layout threads issue on mobile devices
• Fixed Bug: Warning: Trying to access array offset on null in ../functions-template.php
• Fixed Bug: Missing field ‘url’ (in ‘author’) with DiscussionForumPosting structured data
• Fixed Bug: Missing field ‘name’ (in ‘comment.author’) with DiscussionForumPosting structured data
• ———
• Version 2.4.3 – 2.4.4
• Added: Discussion forum (DiscussionForumPosting) structured data for Google Search
• Security: Fixed issue with manipulation and privilege escalation via hidden parameter
• Fixed Bug: BuddyPress Integration problems related to deprecated functions
• Fixed Bug: False positive spam file detection and notification in the dashboard
• Fixed Bug: Problems related to PHP 8.4
• Fixed Bug: Issues with saving antispam settings
• Fixed Bug: More robust solution for “Arbitrary File Reading” problem by changing wp_remote_get() function to wp_safe_remote_get()
• ———
• Version 2.4.2
• Security: Unauthenticated Arbitrary File Read in update
• Fixed Bug: In some cases user couldn’t see own private topics
• Fixed Bug: Problem with topic slugs containing negative number (-1234)
• Fixed Bug: Issue with x.com URL in users profile pages
• Fixed Bug: Forum tree displaying issue related the secondary user-groups cache
• ———
• Version 2.4.1
• Compatibility: WordPress 6.7
• Added: Request confirmation before deleting the account
• Added: Email notification to admins when users delete their account
• ———
• Version 2.4.0
• Added: Export and Import of settings. Allows you to export and import different groups of settings separately.
• Added: Automatically change a post status to unapproved when an eligible user report it.
• Added: reCAPTCHA to the [Add Topic] form in stand-alone topic creation page (/add-topic/)
• SEO Optimization: Prevent indexing dynamic URLs with get parameters for when page is generated after selecting options in dropdown menus.
• SEO Optimization: Added rel=”nofollow” to links in the user activity and favored pages.
• Changed: Topic and post shortlinks previously showed a 404 error if the content was private or unapproved. Now, they redirect to the login page to authorize the user before displaying the content.
• New Addon: wpForo – Advanced Reactions

wpForo Forum 2.3.0 – 2.3.5 | 01.08.2024

wpForo Forum v2.3 Release Summary

• Version 2.3.5
• Compatibility: WordPress 6.6
• Changed: Display access title instead of the key in the forum access table
• Fixed Bug: Issue with deleting own account
• Fixed Bug: Vulnerability issue (Sensitive Data Exposure)
• ———
• Version 2.3.4
• Fixed Bug: Vulnerability issue (By authenticated (Contributor+ users) SQL Injection)
• Fixed Bug: Invisible replies in private topics
• Fixed Bug: Prevent reCaptcha from being checked more than once
• ———
• Version 2.3.3
• Changed: File naming logic of profile cover images
• Changed: Ordering of forums and sub-forums in Threaded Layout
• Changed: Using post’s short URL for [post_link] shortcode in email templates
• Fixed Bug: Performance issue with large number of members
• Fixed Bug: Permission issue with subscriptions and email notifications
• ———
• Version 2.3.2
• Fixed Bug: Compatibility issue with some page builders
• Fixed Bug: Dynamic Usergroup and User Role synchronization issues
• Fixed Bug: Member search ordering issue (used by User Mentioning addon)
• Fixed Bug: Custom values for max and minimum number of characters in the user password
• ———
• Version 2.3.1
• Fixed Bug: Member search issue when use profile title
• Fixed Bug: Usergroup and User Role synchronization issues
• Fixed Bug: Editor focusing issue when using stickers and emojis
• Fixed Bug: Permission issue for Authors to use Cross Posting addon
• Fixed Bug: CSS Issue with the red circle notification on the admin bar
• New Addon: wpForo – Groups Plugin Integration
• ———
• Version 2.3.0
• Added: Option to change wpForo sidebar location (left or right)
• Added: Red circle notification on the forum menu when there are unapproved posts
• Added: Extended the max rating level to 14, use wpforo_max_rating_levels hook
  • PHP code snippet example:
  • add_filter(‘wpforo_max_rating_levels’, function($count){return 14;});
• Improved: Topic search and suggestion when creating a new topic
• Fixed Bug: Last login is incorrectly displaying current time in Dashboard > Members
• Fixed Bug: Database Error: Syntax error, unexpected ‘@’, when search words contain @
• Fixed Bug: Database Error on duplication key in _wpforo_visits table
• Fixed Bug: PHP Error: Trying to access array on null in /profile-subscriptions.php on line 18

wpForo Forum 2.2.0 – 2.2.10 | 03.01.2024

wpForo Forum v2.2 Release Summary

• Version 2.2.10
• Added: New hooks requested by many developers
• Fixed Bug: Improved the init_current_object() function to avoid PHP errors
• Fixed Bug: Fix wpforo_urlencode() to lowcase URLs carefully
• New Addon: wpForo – User Mentioning
• Addon Update: wpForo – User Custom Field – Added [wpforo-members] shortcode with user fields filters and sorting parameters
• ———
• Version 2.2.9
• Added: Topic type classes to wrapper divs for better styling
• Added: Classes to all dates in topics and posts
• Fixed Bug: Vulnerable to Cross Site Request Forgery (CSRF)
• Fixed Bug: PHP Fatal error when BuddyPress or Ultimate Member is deactivated
• Fixed Bug: Emoji encoding issue to be saved in utf8mb4 database tables
• Fixed Bug: rel=”noindex,nofollow” to JS popup login and registration links
• ———
• Version 2.2.8
• Added: Display subforums’ topics with the parent forum topics
• Added: Can post and can listen to voice posting permissions
• Fixed Bug: Fixed some font awesome icons
• Fixed Bug: PHP Fatal Errors
• Fixed Bug: Problems with options cache
• New Addon: wpForo – Voice Posting
• ———
• Version 2.2.7
• Improved: Forum search supports exact phrase search and boolean search:
  • For example: “search phrase” for exact phrase search
  • For example: +search +phrase for boolean search (“+” means AND;
  • For example: -“search phrase” for boolean search (“-” means NOT)
  • For example: search* for wildcard search
• Added: rel=”nofollow” to share buttons and links
• Updated: Font Awesome to 6.5.1
• Updated: Replaced twitter share buttons to X, with icons and colors
• Hooks: Added hooks to display user fields on posts and member list using wpForo User Custom Fields addon
• ———
• Version 2.2.6
• Added: Detecting the timezone from the user’s browser if it’s not set in the account settings
• Fixed Bug: Vulnerable to Cross Site Request Forgery (CSRF)
• ———
• Version 2.2.5
• Compatibility: Adopted with old 7.x PHP version to avoid PHP errors
• Fixed Bug: Last post information on forum list
• Fixed Bug: Forum participants avatars
• Fixed Bug: Vulnerability to Content Injection
• Fixed Bug: Vulnerable to Cross Site Request Forgery (CSRF)
• Fixed Bug: PHP error / Syntax error, unexpected ‘|’, expected variable (T_VARIABLE))
• Fixed Bug: PHP error / Typed property wpforoclassesCache::$dir must not be accessed before initialization
• Fixed Bug: PHP error / Argument #2 ($haystack) must be of type array, null given in includes/hooks.php:1528
• Fixed Bug: PHP error / Trying to access array offset on value of type null in themes/2022/layouts/2/post.php
• Fixed Bug: Fatal error on user login and registration
• ———
• Version 2.2.4
• Compatibility: WordPress 6.4
• Added: Hook to control enabled activity types for BuddyPress integration
• Added: Better performance of Simplified forum layout
• Changed: Twitter to X, icons and labels
• Fixed Bug: XSS vulnerability issue
• Fixed Bug: User registration vulnerability
• Fixed Bug: Validating uploaded avatar files
• Fixed Bug: No way to select empty value for dropdown field
• Fixed Bug: Fatal error: array_merge() argument #2 must be of type array, null given in wpforo/classes/Activity.php:217
• ———
• Version 2.2.3
• Added: New hooks for activity editing and deleting methods
• Added: Suggesting correct page for setting forum as the home page
• Fixed Bug: Statistic issue on forum list of the Simplified Layout
• Fixed Bug: Remove auto-generation of log files
• Fixed Bug: 404 error when accessing URLs with postid in numeric permalink structure
• New Addon: wpForo – Paid Memberships Pro Integration
• ———
• Version 2.2.2
• Added: Increase max length of avatar URL field
• Added: Synchronize user roles and usergroups when roles are updated
• Fixed Bug: Issue with adding new forum access in non-latin languages
• Fixed Bug: Secondary usergroups syncing issue with multiple user roles
• New Addon: wpForo – MemberPress Integration
• New Addon: wpForo – SureMembers Integration
• ———
• Version 2.2.1
• Fixed Bug: PHP Error with Blog-Forum Cross Posting addon
• Fixed Bug: Forum board pageid shows “not found” message for Forum Admin
• Fixed Bug: Permission issue with editing of forum cover image
• ———
• Version 2.2.0
• Compatibility: WordPress 6.3
• Added: Button to copy a forum with all settings and permissions in dashboard
• Added: Filter hook to change wpForo forum cache directory wpforo_cache_dir
• Added: New email shortcodes [user_group_name], [user_secondary_group_names]
• Added: Improved forum canonical URL generation and filtering unnecessary parts
• Added: Flexible forum tag separator, hook to change wpforo_tag_separator
• Added: Shortcode for activity, account, and other forum profile pages
  • For example [wpforo item=”activity” id=”1″], the id is a user ID
• Fixed Bug: PHP Fatal error when disable following and subscriptions modules
• Fixed Bug: Issue with arabic comma in topic tags
• Fixed Bug: RTL issues with some font-awesome forum icons
• Fixed Bug: RTL issues with forum tags