CVE-2026-119155

Name of the Vulnerable Software and Affected Versions wpForo Forum versions prior to 3.2.3

Description An unauthenticated time-based SQL Injection exists due to insufficient escaping of user-supplied input and lack of proper preparation of the SQL query. This allows attackers to append additional SQL queries to extract sensitive information from the database. The attack targets the href[locale] parameter. The required nonce is publicly available to unauthenticated visitors on any forum page via the wpforo.nonces JavaScript object, requiring only a page load for acquisition.

Recommendations Update to version 3.2.3 or later. Avoid using the href[locale] parameter until the update is applied.