CVE-2026-95870

Name of the Vulnerable Software and Affected Versions wpForo Forum plugin for WordPress versions prior to 3.2.2

Description An issue exists where unauthenticated attackers can perform SQL Injection, a technique used to interfere with the queries that an application makes to its database. This occurs due to insufficient escaping of user-supplied input and lack of proper preparation of the SQL query. The flaw is triggered via the data parameter. Successful exploitation allows the extraction of sensitive information from the database. This requires a searchable topic form field of type checkbox, or a select/autocomplete field with isMultiChoice enabled, to be registered in the forum configuration.

Recommendations Update the plugin to version 3.2.2 or later.