PT-2026-22480 · WordPress · Wpforo Forum

Scott Moore · Publicado 2026-02-28 · Atualizado 2026-03-04 · CVE-2026-28559

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Média

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions wpForo Forum version 2.4.14

Description The software contains an information disclosure issue that allows unauthenticated users to retrieve private and unapproved forum topics. This is possible through the global RSS feed endpoint. When requesting the RSS feed without a forum ID parameter, the privacy and status restrictions are bypassed, as the query does not apply the necessary WHERE clauses. The vulnerable endpoint is /wp-content/plugins/wpforo/rss.php. The issue allows unauthorized access to forum topics.

Recommendations Apply a fix to ensure the privacy and status WHERE clauses are correctly applied when a forum ID parameter is not provided to the /wp-content/plugins/wpforo/rss.php endpoint.

Correção

Information Disclosure

Enumeração de Fraquezas

CWE-200

Identificadores relacionados

CVE-2026-28559

Produtos afetados

Wpforo Forum

Referências · 10

• https://t.me/cveNotify/153651 · Publicação no Telegram
• https://twitter.com/VulmonFeeds/status/2027889611624620414 · Publicação no Twitter
• https://t.me/cveNotify/154060 · Publicação no Telegram
• https://osv.dev/vulnerability/CVE-2026-28559 · Aviso do Fabricante
• https://vulncheck.com/advisories/wpforo-forum-information-disclosure-via-global-rss-feed · Nota
• https://twitter.com/cyberbivash/status/2027915535510294576 · Publicação no Twitter
• https://wordpress.org/plugins/wpforo/#developers · Correção
• https://wordpress.org/plugins/wpforo · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2026-28559 · Nota de Segurança
• https://t.me/CVEtracker/46047 · Publicação no Telegram