wpForo Forum vulnerabilities

3 known vulnerabilities in wpForo Forum from gVectors Team. 3 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 9.8 Critical severity

  wpForo Forum: Improper Neutralization of Special Elements used in an SQL Command

  CVE-2026-28562Feb 28, 2026gVectors Team

  wpForo 2.4.14 contains an unauthenticated SQL injection vulnerability in Topics::get_topics() where the ORDER BY clause relies on ineffective esc_sql() sanitization on unquoted identifiers. Attackers exploit the wpfob parameter with CASE WHEN payloads to perfo

• 7.5 High severity

  wpForo Forum: Exposure of Sensitive Information to an Unauthorized Actor

  CVE-2024-43289Aug 26, 2024gVectors Team

  Exposure of Sensitive Information to an Unauthorized Actor vulnerability in gVectors Team wpForo Forum.This issue affects wpForo Forum: from n/a through 2.3.4.

• 8.8 High severity

  wpForo Forum: Cross-Site Request Forgery

  CVE-2023-47870Nov 30, 2023gVectors Team

  Cross-Site Request Forgery (CSRF), Missing Authorization vulnerability in gVectors Team wpForo Forum wpforo allows Cross Site Request Forgery, Accessing Functionality Not Properly Constrained by ACLs leading to forced all users log out.This issue affects wpFor