PT-2026-22475 · WordPress · Wpforo Forum

Scott Moore · Published 2026-02-28 · Updated 2026-03-05 · CVE-2026-28554

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions wpForo Forum version 2.4.14

Description The software contains a flaw due to missing authorization checks. An authenticated subscriber can approve or unapprove any forum post by exploiting the wpforo approve ajax AJAX handler. The check relies solely on a nonce, which can be bypassed by submitting a valid nonce along with an arbitrary post ID, effectively circumventing moderation controls.

Recommendations Update to a newer version that contains a fix for this vulnerability. As a temporary workaround, consider restricting access to the wpforo approve ajax handler to authorized personnel only.

Fix

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

CVE-2026-28554

Affected Products

Wpforo Forum

References · 9

• https://wordpress.org/plugins/wpforo/#developers · Patch
• https://osv.dev/vulnerability/CVE-2026-28554 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-28554 · Security Note
• https://twitter.com/VulmonFeeds/status/2027897291294511417 · Twitter Post
• https://wordpress.org/plugins/wpforo · Note
• https://t.me/cveNotify/154342 · Telegram Post
• https://vulncheck.com/advisories/wpforo-forum-missing-authorization-via-post-approval-ajax-handler · Note
• https://t.me/cveNotify/153646 · Telegram Post
• https://t.me/CVEtracker/46042 · Telegram Post