PT-2026-20865 · WordPress · Wpforo Forum

Youssef Elouaer · Published 2026-02-19 · Updated 2026-04-13 · CVE-2026-1581

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions wpForo Forum plugin versions prior to 2.4.15

Description The wpForo Forum plugin for WordPress is susceptible to time-based SQL Injection through the wpfob parameter. Insufficient escaping of user-supplied input and inadequate SQL query preparation allow unauthenticated attackers to inject additional SQL queries into existing ones. This can lead to the extraction of sensitive information from the database.

Recommendations Update the wpForo Forum plugin to version 2.4.15 or later.

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2026-1581

Affected Products

Wpforo Forum

References · 11

• https://nvd.nist.gov/vuln/detail/CVE-2026-1581 · Security Note
• https://twitter.com/grok/status/2025324624674795936 · Twitter Post
• https://twitter.com/pdnuclei_bot/status/2034993398302822747 · Twitter Post
• https://i.redd.it/vebrk5flqxug1.png · Reddit Post
• https://plugins.trac.wordpress.org/browser/wpforo/trunk/classes/Topics.php#L1702 · Note
• https://plugins.trac.wordpress.org/browser/wpforo/trunk/wpforo.php#L1077 · Note
• https://plugins.trac.wordpress.org/changeset/3459801 · Note
• https://wordfence.com/threat-intel/vulnerabilities/id/4c447dbb-f8fb-4b46-9c47-20ab7330bbaa?source=cve · Note
• https://twitter.com/VulmonFeeds/status/2024673721605120371 · Twitter Post
• https://twitter.com/CVEnew/status/2025892047542984947 · Twitter Post
• https://twitter.com/VolerionSec/status/2024550424955482226 · Twitter Post