PT-2026-22475 · WordPress · Wpforo Forum

Scott Moore · Publicado 2026-02-28 · Atualizado 2026-03-05 · CVE-2026-28554

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Média

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions wpForo Forum version 2.4.14

Description The software contains a flaw due to missing authorization checks. An authenticated subscriber can approve or unapprove any forum post by exploiting the wpforo approve ajax AJAX handler. The check relies solely on a nonce, which can be bypassed by submitting a valid nonce along with an arbitrary post ID, effectively circumventing moderation controls.

Recommendations Update to a newer version that contains a fix for this vulnerability. As a temporary workaround, consider restricting access to the wpforo approve ajax handler to authorized personnel only.

Correção

Missing Authorization

Enumeração de Fraquezas

CWE-862

Identificadores relacionados

CVE-2026-28554

Produtos afetados

Wpforo Forum

Referências · 9

• https://wordpress.org/plugins/wpforo/#developers · Correção
• https://twitter.com/VulmonFeeds/status/2027897291294511417 · Publicação no Twitter
• https://wordpress.org/plugins/wpforo · Nota
• https://t.me/cveNotify/154342 · Publicação no Telegram
• https://vulncheck.com/advisories/wpforo-forum-missing-authorization-via-post-approval-ajax-handler · Nota
• https://osv.dev/vulnerability/CVE-2026-28554 · Aviso do Fabricante
• https://t.me/cveNotify/153646 · Publicação no Telegram
• https://t.me/CVEtracker/46042 · Publicação no Telegram
• https://nvd.nist.gov/vuln/detail/CVE-2026-28554 · Nota de Segurança