CVE-2026-28562

EUVD-2026-9111
wpForo 2.4.14 contains an unauthenticated SQL injection vulnerability in Topics::get_topics() where the ORDER BY clause relies on ineffective esc_sql() sanitization on unquoted identifiers. Attackers exploit the wpfob parameter with CASE WHEN payloads to perform blind boolean extraction of credentials from the WordPress database.
SQL Injection
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
8.2 HIGH
NETWORK
LOW
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N
Base Score
CVSS 3.x
EPSS Score
Percentile: Unknown
Affected Products (NVD)
VendorProductVersion
gvectorswpforo_forum
2.4.0 ≤
𝑥
< 2.4.15
𝑥
= Vulnerable software versions
Common Weakness Enumeration
References
https://wordpress.org/plugins/wpforo/
https://wordpress.org/plugins/wpforo/#developers
https://www.vulncheck.com/advisories/wpforo-sql-injection-via-topics-order-by-parameter