CVE-2025-13126

Name of the Vulnerable Software and Affected Versions wpForo Forum plugin for WordPress versions prior to 2.4.13

Description The wpForo Forum plugin for WordPress is susceptible to SQL Injection. Insufficient input sanitization on user-supplied parameters and inadequate SQL query preparation allow unauthenticated attackers to inject additional SQL queries into existing database queries. This could lead to the extraction of sensitive information from the database via the post args and topic args parameters.

Recommendations Update the wpForo Forum plugin to version 2.4.13 or later.