PT-2026-20865

CVE-2026-1581

·

Published

2026-02-18

·

Updated

2026-10-02

Description by

CVSS 3.1
7.5
High
MetricsAV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Name of the Vulnerable Software and Affected Versions wpForo Forum plugin versions prior to 2.4.15
Description The wpForo Forum plugin for WordPress is susceptible to time-based SQL Injection through the wpfob parameter. Insufficient escaping of user-supplied input and inadequate SQL query preparation allow unauthenticated attackers to inject additional SQL queries into existing ones. This can lead to the extraction of sensitive information from the database.
Recommendations Update the wpForo Forum plugin to version 2.4.15 or later.
Exploitability
Fix
Impacts
Researchers
Vendors
Affected products
Weakness enumeration
CWE-89: Improper Neutralization of Special Elements used in an SQL Command (\'SQL Injection\')
Related identifiers
CVE-2026-1581
Found an issue in the description? Have something to add? Feel free to write us 👾
dbugs@ptsecurity.com