Scriptsbundle AdForest vulnerabilities

🔔 Create alert RSS Version checker

Published CVEs affecting Scriptsbundle AdForest: 3 record(s), with affected versions and fixes.

CVE-2026-1729 Critical · 9.8 CWE-306 Feb 11, 2026

AdForest <= 6.0.12 - Authentication Bypass

The AdForest theme for WordPress is vulnerable to authentication bypass in all versions up to, and including, 6.0.12. This is due to the plugin not properly verifying a user's identity prior to authenticating them through the 'sb_login_user_with_otp_fun' function. This makes it possible for unauthenticated attackers to log in as arbitrary users, including administrators.

CVE-2025-67946 High · 8.1 CWE-98 Jan 22, 2026

WordPress AdForest theme <= 6.0.11 - Local File Inclusion vulnerability

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in scriptsbundle AdForest adforest allows PHP Local File Inclusion.This issue affects AdForest: from n/a through <= 6.0.11.

CVE-2025-67569 Medium · 5.3 CWE-862 Dec 9, 2025

WordPress AdForest theme <= 6.0.11 - Broken Access Control vulnerability

Missing Authorization vulnerability in scriptsbundle AdForest adforest allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects AdForest: from n/a through <= 6.0.11.