CVE-2026-28562:

Unauthenticated SQL injection vulnerability in wpForo 2.4.14 allows attackers to extract credentials from WordPress databases.

Score
A numerical rating that indicates how dangerous this vulnerability is.

9.8Critical

Published Date:Feb 28, 2026
CISA KEV Date:*No Data*
Industries Affected:20

Threat Predictions

EPSS Score:0.0
EPSS Percentile:2%

Exploitability

Score:3.9
Attack Vector:NETWORK
Attack Complexity:LOW
Privileges Required:NONE
User Interaction:NONE
Scope:UNCHANGED

Impact

Score:5.9
Confidentiality Impact:HIGH
Integrity Impact:HIGH
Availability Impact:HIGH

Description Preview

Unauthenticated SQL injection vulnerability in wpForo 2.4.14 allows attackers to extract credentials from WordPress databases.

Overview

The vulnerability in wpForo 2.4.14 presents a critical security risk for WordPress websites using this forum plugin. The unauthenticated nature of the exploit means that attackers do not need valid credentials to initiate an attack. By manipulating the wpfob parameter, malicious actors can craft SQL injection payloads that bypass the ineffective esc_sql() sanitization. This allows for the extraction of sensitive information, particularly user credentials, from the WordPress database using blind boolean-based techniques. The CVSS v3.1 base score of 9.8 (Critical) underscores the severity of this vulnerability, indicating high impact on confidentiality, integrity, and availability with low attack complexity.

Remediation

To mitigate this vulnerability, website administrators should take the following actions:
1. Update wpForo to version 2.4.15 or later immediately. This version likely contains patches for the identified SQL injection vulnerability.
2. If immediate updating is not possible, consider temporarily disabling the wpForo plugin until an update can be applied.
3. Implement additional security measures such as Web Application Firewalls (WAF) that can help detect and block SQL injection attempts.
4. Regularly audit and update all WordPress plugins, themes, and core installations to ensure the latest security patches are applied.
5. Consider implementing the principle of least privilege for database users and segregating sensitive data to minimize potential damage from successful exploits.
6. Monitor server logs for suspicious activities or unexpected queries that could indicate exploitation attempts.
7. Conduct a thorough security assessment of the WordPress installation to identify and address any other potential vulnerabilities.