Skip to content
PluginCanary

wpForo Forum

by Tomdever · 20,000+ active installs · Checked 4 Nov 2026
Healthy

Healthy: maintained, last release 2 Nov 2026, 44 releases in 24 months, no unpatched vulnerabilities.

86/ 100 Canary Score
Sub-scores for wpForo Forum
Ownership100
Maintenance100
Security60
SupportNo data
ReputationNo data

How the score works

Quick answers

Is wpForo Forum still maintained?
Yes. Last release 2 Nov 2026, 44 releases in the last 24 months. 2 Nov 2026 · wordpress.org
Who owns wpForo Forum, and has it changed hands?
No change recorded. Main committer Tomdever since Jun 2016. 4 Nov 2026 · SVN log
Was wpForo Forum removed from wordpress.org?
No. Listed on wordpress.org as of 4 Nov 2026. 4 Nov 2026 · wordpress.org
Is wpForo Forum safe?
54 known vulnerabilities, all fixed (latest in 3.1.7). Not on the exploited list. 24 Sep 2026 · Wordfence Intelligence
Is the latest wpForo Forum update safe to install?
No ownership change before 3.2.4. No one-star spike after it. 2 Nov 2026 · Release history

Active signals

Facts we detected, with links to the source.

No open risk signals. Signals appear here when we detect an ownership change, closure, vulnerability or decline.

Ownership timeline

Who commits to the plugin's code on wordpress.org, over time.

Committers and their active periods
Tomdever26 Jun 2016 to 2 Nov 2026, 611 commits

1 committer recorded. No ownership change since 2016.

Maintenance

Last release
2 days ago
Releases, 24 months
44
Tested up to
7.1 current
Requires PHP
7.1 supported 8.2+
Releases per quarter
Releases per quarter for wpForo Forum
Q1 20245
Q2 20241
Q3 20242
Q4 20241
Q1 20254
Q2 20250
Q3 20253
Q4 20255
Q1 20264
Q2 202612
Q3 20269
Q4 20266

Last release 2 Nov 2026. Tested with WordPress 7.1 (current).

Reputation

Last 90 days: no reviews. Lifetime: 4.7.

Average rating per quarter for wpForo Forum
Q4 20234.2
Q1 20245.0
Q2 20245.0
Q3 20243.0
Q1 20255.0
Q2 20255.0
Q3 20255.0
Q4 20255.0
Q1 20265.0

Average rating rose from 4.2 to 5.0 between Q4 2023 and Q1 2026.

Rating distribution
5 star350
4 star14
3 star7
2 star3
1 star16
Latest low reviews

Security record

30 vulnerabilities in 24 months (54 on record), all patched (latest fixed in 3.1.7).

Show 54 patched vulnerabilities
PublishedIssueCVSSAffectedFixed inDays to patch
24 Sep 2026wpForo Forum <= 3.1.6 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'telegram' Profile Field6.4<= 3.1.63.1.7Patched before disclosure
23 Sep 2026wpForo Forum <= 3.1.5 - Authenticated (Subscriber+) Stored Cross-Site Scripting6.4<= 3.1.53.1.6Patched before disclosure
22 Sep 2026wpForo Forum 3.0.0 - 3.1.5 - Unauthenticated AI Credit Exhaustion5.33.0.0 to 3.1.53.1.6Patched before disclosure
22 Sep 2026wpForo Forum <= 3.1.5 - Authenticated (Subscriber+) PHP Object Injection7.5<= 3.1.53.1.6Patched before disclosure
21 Sep 2026wpForo Forum <= 3.1.5 - Missing Authorization to Authenticated (Subscriber+) Guest Post Takeover via wpforo_post_edit Action / Forged comment_author_email Cookie4.3<= 3.1.53.1.6Patched before disclosure
27 Aug 2026wpForo Forum <= 2.4.17 - Unauthenticated SQL Injection via 'referer' Parameter7.5<= 2.4.173.0.0Patched before disclosure
27 Jul 2026wpForo Forum <= 3.1.2 - Missing Authorization to Authenticated (Subscriber+) Account Status Manipulation4.3<= 3.1.23.1.3Patched before disclosure
20 Jul 2026wpForo Forum <= 3.1.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting6.4<= 3.1.13.1.2Patched before disclosure
16 Jul 2026wpForo Forum <= 3.1.1 - Insecure Direct Object Reference to Authenticated (Subscriber+) Chat Message Deletion4.3<= 3.1.13.1.2Patched before disclosure
15 Jul 2026wpForo Forum <= 3.1.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'location' Profile Field6.4<= 3.1.13.1.2Patched before disclosure
26 Jun 2026wpForo Forum <= 3.0.9 - Authenticated (Contributor+) SQL Injection6.5<= 3.0.93.1.0Patched before disclosure
4 Jun 2026wpForo Forum <= 3.1.0 - Missing Authorization5.3<= 3.1.03.1.1Patched before disclosure
4 Jun 2026wpForo Forum <= 3.1.0 - Unauthenticated PHP Object Injection8.1<= 3.1.03.1.1Patched before disclosure
18 May 2026wpForo Forum <= 3.0.6 - Missing Authorization5.3<= 3.0.63.0.7Patched before disclosure
7 May 2026wpForo Forum <= 3.0.4 - Unauthenticated SQL Injection7.5<= 3.0.43.0.5Patched before disclosure
21 Apr 2026wpForo Forum < 3.0.2 - Missing Authorization5.3< 3.0.23.0.2Patched before disclosure
20 Apr 2026wpForo Forum <= 3.0.5 - Authenticated (Subscriber+) Arbitrary File Deletion via Custom Profile Field File Path8.1<= 3.0.53.0.6Patched before disclosure
16 Apr 2026wpForo Forum <= 2.4.16 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Forum Post Modification via 'guestposting' Parameter6.5<= 2.4.163.0.0Patched before disclosure
10 Apr 2026wpForo Forum <= 3.0.2 - Authenticated (Subscriber+) Arbitrary File Deletion via 'data[body][fileurl]' Parameter7.1<= 3.0.23.0.3Patched before disclosure
3 Apr 2026wpForo Forum <= 2.4.16 - Authenticated (Subscriber+) Arbitrary File Deletion via Post Body8.8<= 2.4.162.4.17Patched before disclosure
18 Feb 2026wpForo Forum <= 2.4.14 - Unauthenticated Time-Based SQL Injection7.5<= 2.4.142.4.15Patched before disclosure
10 Feb 2026wpForo Forum <= 2.4.13 - Authenticated (Subscriber+) PHP Object Injection8.8<= 2.4.132.4.14Patched before disclosure
13 Dec 2025wpForo Forum <= 2.4.12 - Unauthenticated SQL Injection7.5<= 2.4.122.4.13Patched before disclosure
18 Nov 2025wpForo Forum <= 2.4.10 - Missing Authorization5.3<= 2.4.102.4.11Patched before disclosure
31 Oct 2025wpForo Forum <= 2.4.9 - Authenticated (Susbscriber+) SQL Injection6.5<= 2.4.92.4.10Patched before disclosure

Sources: Wordfence Intelligence, CISA Known Exploited Vulnerabilities, readme changelogs.

Support

100% of 4 support threads resolved in the last 2 months.

Momentum

20,000+ active installs. History builds with each weekly snapshot.

Weekly downloads, last 27 weeks
Weekly downloads for wpForo Forum
4 May 2026808
11 May 20261,870
18 May 202610,922
25 May 20266,072
1 Jun 20266,921
8 Jun 20262,355
15 Jun 20261,364
22 Jun 20261,186
29 Jun 20261,157
6 Jul 20267,022
13 Jul 20266,126
20 Jul 20269,563
27 Jul 20262,701
3 Aug 20262,810
10 Aug 20263,646
17 Aug 20269,297
24 Aug 20262,392
31 Aug 20261,920
7 Sep 20261,593
14 Sep 20269,444
21 Sep 202627,846
28 Sep 202614,649
5 Oct 20264,609
12 Oct 20262,330
19 Oct 20263,308
26 Oct 20264,903
2 Nov 20267,624

Weekly downloads over the last 4 weeks are 21% below the 27-week average.

Healthier alternatives

Same job, rated Healthy, higher Canary Score and at least 10,000 installs. Never sponsored.

No healthier plugin in the same category yet.

Facts

Version3.2.4
AuthorTomdever
Added26 Jun 2016
Last updated2 Nov 2026
Active installs20,000+
Requires WordPress5.2
Tested up to7.1.4
Requires PHP7.1
CategoryCommunity & Social > Forums & Discussion Boards
Tagsforum, forums, bbPress, community, forum plugin

Questions

Is wpForo Forum still maintained?

Yes. Last release 2 Nov 2026, 44 releases in the last 24 months.

Who owns wpForo Forum, and has it changed hands?

No change recorded. Main committer Tomdever since Jun 2016.

Was wpForo Forum removed from wordpress.org?

No. Listed on wordpress.org as of 4 Nov 2026.

Is wpForo Forum safe?

54 known vulnerabilities, all fixed (latest in 3.1.7). Not on the exploited list.

Is the latest wpForo Forum update safe to install?

No ownership change before 3.2.4. No one-star spike after it.

Data: wordpress.org Plugins API, plugins SVN and Trac, wordpress.org reviews and support forum, Wordfence Intelligence, CISA KEV, NVD.Plugin data refreshed 4 Nov 2026.Report a data issue