Vulnerability Description
wpForo 2.4.14 contains an unauthenticated SQL injection vulnerability in Topics::get_topics() where the ORDER BY clause relies on ineffective esc_sql() sanitization on unquoted identifiers. Attackers exploit the wpfob parameter with CASE WHEN payloads to perform blind boolean extraction of credentials from the WordPress database.
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Gvectors | Wpforo Forum | >= 2.4.0, < 2.4.15 |
Related Weaknesses (CWE)
References
- https://wordpress.org/plugins/wpforo/Product
- https://wordpress.org/plugins/wpforo/#developersRelease Notes
- https://www.vulncheck.com/advisories/wpforo-sql-injection-via-topics-order-by-paThird Party Advisory
FAQ
What is CVE-2026-28562?
CVE-2026-28562 is a vulnerability with a CVSS score of 8.2 (HIGH). wpForo 2.4.14 contains an unauthenticated SQL injection vulnerability in Topics::get_topics() where the ORDER BY clause relies on ineffective esc_sql() sanitization on unquoted identifiers. Attackers ...
How severe is CVE-2026-28562?
CVE-2026-28562 has been rated HIGH with a CVSS base score of 8.2/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-28562?
Check the references section above for vendor advisories and patch information. Affected products include: Gvectors Wpforo Forum.