CVE-2026-28555

Name of the Vulnerable Software and Affected Versions wpForo Forum version 2.4.14

Description The software contains a missing authorization flaw. Authenticated subscribers can close or reopen any forum topic through the wpforo close ajax handler. An attacker can bypass the moderator permission requirement by submitting a valid nonce along with an arbitrary topic ID, potentially disrupting forum discussions.

Recommendations Update to a newer version that contains a fix for this vulnerability. As a temporary workaround, consider restricting access to the wpforo close ajax handler.