CVE-2026-28562

wpForo Forum 2.4.14 SQL Injection via Topics ORDER BY Parameter

State: Published
Severity: 8.8 High
Published: Feb 28, 2026
Updated: May 11, 2026
Reserved: Feb 28, 2026

Description

wpForo 2.4.14 contains an unauthenticated SQL injection vulnerability in Topics::get_topics() where the ORDER BY clause relies on ineffective esc_sql() sanitization on unquoted identifiers. Attackers exploit the wpfob parameter with CASE WHEN payloads to perform blind boolean extraction of credentials from the WordPress database.

Scores

CVSS	Score	Vector	Source
4.0	8.8 High	CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N	VulnCheck
3.1	8.2 High	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N	VulnCheck

Weaknesses

CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

Affected Products

Product	Versions
wpForo ForumgVectors Team	2.4 to before 2.4.15Affected 2.4.15Not affected

References

wpForo Forum WordPress Pluginproduct
wpForo Forum Contributors & Developerspatch
VulnCheck Advisory: wpForo 2.4.14 SQL Injection via Topics ORDER BY Parameterthird-party-advisory

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.