CVE-2026-28559

wpForo Forum 2.4.14 Information Disclosure via Global RSS Feed

State: Published
Severity: 6.9 Medium
Published: Feb 28, 2026
Updated: May 11, 2026
Reserved: Feb 28, 2026

Description

wpForo Forum 2.4.14 contains an information disclosure vulnerability that allows unauthenticated users to retrieve private and unapproved forum topics via the global RSS feed endpoint. Attackers request the RSS feed without a forum ID parameter, bypassing the privacy and status WHERE clauses that are only applied when a specific forum ID is present in the query.

Scores

CVSS	Score	Vector	Source
4.0	6.9 Medium	CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N	VulnCheck
3.1	5.3 Medium	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N	VulnCheck

Weaknesses

CWE-200 Exposure of Sensitive Information to an Unauthorized Actor

Affected Products

Product	Versions
wpForo ForumgVectors Team	2.4 to before 2.4.16Affected 2.4.16Not affected

References

wpForo Forum WordPress Pluginproduct
wpForo Forum Contributors & Developerspatch
VulnCheck Advisory: wpForo Forum 2.4.14 Information Disclosure via Global RSS Feedthird-party-advisory

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.