PT-2026-22483 · WordPress · Wpforo

Scott Moore · Publicado 2026-02-28 · Atualizado 2026-03-05 · CVE-2026-28562

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions wpForo version 2.4.14

Description The software contains an unauthenticated SQL injection issue in the Topics::get topics() function. The problem stems from ineffective sanitization using esc sql() on unquoted identifiers within the ORDER BY clause. An attacker can exploit this by manipulating the wpfob parameter with CASE WHEN payloads to extract credentials from the WordPress database in a blind boolean fashion.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

SQL injection

Enumeração de Fraquezas

CWE-89

Identificadores relacionados

CVE-2026-28562

Produtos afetados

Wpforo

Referências · 10

• https://twitter.com/cracbot/status/2029512292036235507 · Publicação no Twitter
• https://twitter.com/TheHackerWire/status/2027870743640609209 · Publicação no Twitter
• https://twitter.com/cyberbivash/status/2027907790744834228 · Publicação no Twitter
• https://vulncheck.com/advisories/wpforo-sql-injection-via-topics-order-by-parameter · Nota
• https://wordpress.org/plugins/wpforo/#developers · Correção
• https://wordpress.org/plugins/wpforo · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2026-28562 · Nota de Segurança
• https://t.me/CVEtracker/46050 · Publicação no Telegram
• https://t.me/cveNotify/154344 · Publicação no Telegram
• https://osv.dev/vulnerability/CVE-2026-28562 · Aviso do Fabricante