Is CVE-2026-119155 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-119155 being exploited in the wild.

How severe is CVE-2026-119155?

High severity, with a CVSS score of 7.5, published 7 November 2026.

Which products and versions are affected?

wpForo Forum up to and including 3.2.2.

Is there a fix for CVE-2026-119155?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-119155 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-119155?

Check whether you run wpForo Forum at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-119155: wpForo Forum SQL injection in href locale parameter

CVE-2026-119155 · Severity: high · CVSS 7.5 · Published 2026-11-07

wpForo is a forum plugin for WordPress that allows users to create and manage online community discussions. An unauthenticated attacker can inject malicious SQL commands through the forum interface to extract sensitive data from the database, such as user credentials or private information. The attack requires no account or prior interaction beyond loading a forum page, since the necessary security token is publicly available to all visitors.

Technologies: wpForo Forum. Vendors: wpForo.

Quick answers

Is CVE-2026-119155 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-119155 being exploited in the wild.
How severe is CVE-2026-119155?: High severity, with a CVSS score of 7.5, published 7 November 2026.
Which products and versions are affected?: wpForo Forum up to and including 3.2.2.
Is there a fix for CVE-2026-119155?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-119155 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-119155?: Check whether you run wpForo Forum at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

This is a time-based SQL injection vulnerability in the 'href[locale]' parameter due to insufficient escaping and lack of prepared statements. An unauthenticated attacker can exploit this vulnerability via the wpForo plugin's web interface; the required nonce is publicly available in the wpforo.nonces JavaScript object on any forum page. A successful exploit allows extraction of arbitrary data from the WordPress database.

Affected products

wpForo wpForo Forum up to and including 3.2.2

Timeline

2026-11-07: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.