PT-2026-22483 · WordPress · Wpforo

Scott Moore · Published 2026-02-28 · Updated 2026-03-05 · CVE-2026-28562

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions wpForo version 2.4.14

Description The software contains an unauthenticated SQL injection issue in the Topics::get topics() function. The problem stems from ineffective sanitization using esc sql() on unquoted identifiers within the ORDER BY clause. An attacker can exploit this by manipulating the wpfob parameter with CASE WHEN payloads to extract credentials from the WordPress database in a blind boolean fashion.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2026-28562

Affected Products

Wpforo

References · 10

• https://wordpress.org/plugins/wpforo/#developers · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-28562 · Security Note
• https://osv.dev/vulnerability/CVE-2026-28562 · Vendor Advisory
• https://twitter.com/cracbot/status/2029512292036235507 · Twitter Post
• https://twitter.com/TheHackerWire/status/2027870743640609209 · Twitter Post
• https://twitter.com/cyberbivash/status/2027907790744834228 · Twitter Post
• https://vulncheck.com/advisories/wpforo-sql-injection-via-topics-order-by-parameter · Note
• https://wordpress.org/plugins/wpforo · Note
• https://t.me/CVEtracker/46050 · Telegram Post
• https://t.me/cveNotify/154344 · Telegram Post