PT-2025-44709 · WordPress · Wpforo Forum

Published 2025-11-01 · Updated 2025-11-21 · CVE-2025-11740

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions wpForo Forum plugin for WordPress versions through 2.4.9

Description The wpForo Forum plugin for WordPress is susceptible to SQL Injection through the Subscriptions Manager. Insufficient escaping of user-supplied parameters and inadequate preparation of existing SQL queries allow authenticated attackers with Subscriber-level access or higher to inject additional SQL queries. This can lead to the extraction of sensitive information from the database.

Recommendations Update the wpForo Forum plugin to a version newer than 2.4.9.

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2025-11740

Affected Products

Wpforo Forum

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2025-11740 · Security Note
• https://t.me/CVEtracker/36365 · Telegram Post
• https://t.me/cveNotify/141238 · Telegram Post
• https://wordfence.com/threat-intel/vulnerabilities/id/aa1eaac2-a23b-4ef6-803a-15f7ec7e5728?source=cve · Note
• https://twitter.com/VulmonFeeds/status/1984521230796382351 · Twitter Post
• https://plugins.trac.wordpress.org/changeset/3386327/wpforo/tags/2.4.10/modules/subscriptions/Subscriptions.php?old=3380558&old_path=wpforo%2Ftags%2F2.4.9%2Fmodules%2Fsubscriptions%2FSubscriptions.php · Note
• https://twitter.com/CVEnew/status/1984498275375071450 · Twitter Post
• https://twitter.com/jmdevlabs/status/1991790649914351641 · Twitter Post