# CVE-2026-119155: wpForo Forum SQL injection in href locale parameter

Source: https://junglewise.ai/threats/cve-2026-119155-the-wpforo-forum-plugin-for-wordpress-is-vulnerable-to-time  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-11-07. Updated: 2026-11-07  
License: CC BY 4.0 with a link back

CVE-2026-119155 · Severity: high · CVSS 7.5 · Published 2026-11-07

wpForo is a forum plugin for WordPress that allows users to create and manage online community discussions. An unauthenticated attacker can inject malicious SQL commands through the forum interface to extract sensitive data from the database, such as user credentials or private information. The attack requires no account or prior interaction beyond loading a forum page, since the necessary security token is publicly available to all visitors.

Technologies: [wpForo Forum](https://junglewise.ai/threats/technologies/wpforo-wpforo-forum). Vendors: [wpForo](https://junglewise.ai/threats/vendors/wpforo).

## Quick answers

**Is CVE-2026-119155 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-119155 being exploited in the wild.

**How severe is CVE-2026-119155?** High severity, with a CVSS score of 7.5, published 7 November 2026.

**Which products and versions are affected?** wpForo Forum up to and including 3.2.2.

**Is there a fix for CVE-2026-119155?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-119155 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-119155?** Check whether you run wpForo Forum at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

This is a time-based SQL injection vulnerability in the 'href[locale]' parameter due to insufficient escaping and lack of prepared statements. An unauthenticated attacker can exploit this vulnerability via the wpForo plugin's web interface; the required nonce is publicly available in the wpforo.nonces JavaScript object on any forum page. A successful exploit allows extraction of arbitrary data from the WordPress database.

## Affected products

- wpForo wpForo Forum up to and including 3.2.2

## Timeline

- 2026-11-07: disclosed

## References

- [https://plugins.trac.wordpress.org/browser/wpforo/tags/3.2.2/classes/Actions.php](https://plugins.trac.wordpress.org/browser/wpforo/tags/3.2.2/classes/Actions.php)
- [https://plugins.trac.wordpress.org/browser/wpforo/tags/3.2.2/classes/Boards.php](https://plugins.trac.wordpress.org/browser/wpforo/tags/3.2.2/classes/Boards.php)

## Related threats

- [WordPress wpForo Forum plugin SQL injection via data parameter](https://junglewise.ai/threats/cve-2026-95870-the-wpforo-forum-plugin-for-wordpress-is-vulnerable-to-generic)
- [wpForo Forum stored cross-site scripting in post body](https://junglewise.ai/threats/cve-2026-120532-the-wpforo-forum-plugin-for-wordpress-is-vulnerable-to-stored)
- [WordPress wpForo Forum plugin privilege escalation in secondary_groupids](https://junglewise.ai/threats/cve-2026-119164-the-wpforo-forum-plugin-for-wordpress-is-vulnerable-to-privilege)
- [wpForo Forum arbitrary file deletion in theme_delete](https://junglewise.ai/threats/cve-2026-110004-the-wpforo-forum-plugin-for-wordpress-is-vulnerable-to-arbitrary)
- [wpForo Forum plugin IP header spoofing in AI rate limiting](https://junglewise.ai/threats/cve-2026-80514-the-wpforo-forum-wordpress-plugin-from-3-0-0-before-3-1-6-does)