Executive brief
wpForo is a popular forum plugin for WordPress used to add discussion and community features to websites. This vulnerability allows unauthenticated attackers to inject malicious SQL commands through the referer parameter, potentially exposing sensitive database information including user credentials, private messages, and other confidential data stored in the forum database.
Technical details
This is a SQL injection vulnerability in the wpForo plugin caused by insufficient input escaping and lack of prepared statement usage on the 'referer' parameter. The vulnerability is network-accessible without authentication requirements, allowing any remote attacker to craft malicious SQL queries. An attacker can append arbitrary SQL commands to extract sensitive information from the WordPress database. The vulnerability affects all versions up to and including 2.4.17.
Affected products
- wpForo wpForo up to and including 2.4.17
Timeline
- 2026-08-28: disclosed