wpForo Forum, CVE-2026-28562
- CVE, Research URL
- Home page URL
- Application
- Published on
- Mar 01, 2026
- Research Description
- wpForo 2.4.14 contains an unauthenticated SQL injection vulnerability in Topics::get_topics() where the ORDER BY clause relies on ineffective esc_sql() sanitization on unquoted identifiers. Attackers exploit the wpfob parameter with CASE WHEN payloads to perform blind boolean extraction of credentials from the WordPress database.
- Affected versions
-
max 2.4.14.
- Status
-
vulnerable