There appears to be a flaw in the above module that a number of people are reporting over on the wpForo forum. I was not aware myself until I saw that thread.
https://wpforo.com/community/how-to-and-troubleshooting-2/user-profile-permissions/#post-15658
One of my members who is in the registered group, managed via their profile account page to change themselves to the moderator group!!!!!
And yes its only happens if you have the wpforo custom fields plugin installed. When I disabled it they could no longer change their group via their account page.
This is serious enough that I have had to remove the User custom fields plugin. Not only doe it allow ordinary members to elevate themselves to moderator status and wreak havoc, they can also read confidential posts in the private moderators only forum section.
Please can we have an solution asap.
