PT-2025-51145 · WordPress · Wpforo Forum+1

Published 2025-12-14 · Updated 2025-12-19 · CVE-2025-13126

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions wpForo Forum plugin for WordPress versions prior to 2.4.13

Description The wpForo Forum plugin for WordPress is susceptible to SQL Injection. Insufficient input sanitization on user-supplied parameters and inadequate SQL query preparation allow unauthenticated attackers to inject additional SQL queries into existing database queries. This could lead to the extraction of sensitive information from the database via the post args and topic args parameters.

Recommendations Update the wpForo Forum plugin to version 2.4.13 or later.

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2025-13126

Affected Products

Wordpress

Wpforo Forum

References · 12

• https://nvd.nist.gov/vuln/detail/CVE-2025-13126 · Security Note
• https://wordfence.com/threat-intel/vulnerabilities/id/fd1704ef-e259-40a3-974b-128145bc8a4a?source=cve · Note
• https://plugins.trac.wordpress.org/browser/wpforo/tags/2.4.10/widgets/RecentTopics.php?rev=3386327#L117 · Note
• https://plugins.trac.wordpress.org/browser/wpforo/tags/2.4.10/widgets/RecentPosts.php?rev=3386327#L177 · Note
• https://t.me/CVEtracker/39753 · Telegram Post
• https://plugins.trac.wordpress.org/browser/wpforo/tags/2.4.10/classes/Posts.php?rev=3386327#L633 · Note
• https://twitter.com/CVEnew/status/2000246123752050868 · Twitter Post
• https://twitter.com/VulmonFeeds/status/2000077354899484893 · Twitter Post
• https://twitter.com/TheHackerWire/status/2000084334154494378 · Twitter Post
• https://twitter.com/cracbot/status/2001970824153350246 · Twitter Post
• https://plugins.trac.wordpress.org/browser/wpforo/tags/2.4.10/classes/Topics.php?rev=3386327#L1641 · Note
• https://t.me/cveNotify/145690 · Telegram Post