wpForo Forum vulnerabilities

15 known vulnerabilities in wpForo Forum from Tomdever. 15 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 7.5 High severity

  wpForo Forum: Improper Neutralization of Special Elements used in an SQL Command

  CVE-2026-95870Nov 7, 2026Tomdever

  The wpForo Forum plugin for WordPress is vulnerable to generic SQL Injection via the 'data' parameter in all versions up to, and including, 3.2.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL

• 7.5 High severity

  wpForo Forum: Improper Privilege Management

  CVE-2026-119164Nov 7, 2026Tomdever

  The wpForo Forum plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 3.2.2 via the `data[secondary_groupids]` parameter of the `wpforo_action_profile_update` POST handler. This is due to a type-confusion flaw in the

• 7.5 High severity

  wpForo Forum: Improper Neutralization of Special Elements used in an SQL Command

  CVE-2026-119155Nov 7, 2026Tomdever

  The wpForo Forum plugin for WordPress is vulnerable to time-based SQL Injection via the 'href[locale]' parameter in all versions up to, and including, 3.2.2 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the e

• 7.5 High severity

  wpForo Forum: Improper Neutralization of Special Elements used in an SQL Command

  CVE-2026-5097Aug 28, 2026Tomdever

  The wpForo Forum plugin for WordPress is vulnerable to SQL Injection via the 'referer' parameter in all versions up to, and including, 2.4.17. This is due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existin

• 9.1 Critical severity

  wpForo Forum: Missing Authorization

  CVE-2026-42682Jun 1, 2026Tomdever

  Missing Authorization vulnerability in Tomdever wpForo Forum allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects wpForo Forum: from n/a through 3.0.6.

• 8.1 High severity

  wpForo Forum: Improper Limitation of a Pathname to a Restricted Directory

  CVE-2026-6248Apr 20, 2026Tomdever

  The wpForo Forum plugin for WordPress is vulnerable to Arbitrary File Deletion in versions up to and including 3.0.5. This is due to two compounding flaws: the Members::update() method does not validate or restrict the value of file-type custom profile fields,

• 7.1 High severity

  wpForo Forum: External Control of File Name or Path

  CVE-2026-5809Apr 11, 2026Tomdever

  The wpForo Forum plugin for WordPress is vulnerable to Arbitrary File Deletion in versions up to and including 3.0.2. This is due to a two-step logic flaw: the topic_add() and topic_edit() action handlers accept arbitrary user-supplied data[*] arrays from $_RE

• 8.8 High severity

  wpForo Forum: Improper Limitation of a Pathname to a Restricted Directory

  CVE-2026-3666Apr 4, 2026Tomdever

  The wpForo Forum plugin for WordPress is vulnerable to arbitrary file deletion in all versions up to, and including, 2.4.16. This is due to a missing file name/path validation against path traversal sequences. This makes it possible for authenticated attackers

• 7.5 High severity

  wpForo Forum: Improper Neutralization of Special Elements used in an SQL Command

  CVE-2026-1581Feb 19, 2026TomdeverEPSS 2.51%

  The wpForo Forum plugin for WordPress is vulnerable to time-based SQL Injection via the 'wpfob' parameter in all versions up to, and including, 2.4.14 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existin

• 8.8 High severity

  wpForo Forum: Deserialization of Untrusted Data

  CVE-2026-0910Feb 11, 2026Tomdever

  The wpForo Forum plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 2.4.13 via deserialization of untrusted input in the 'wpforo_display_array_data' function. This makes it possible for authenticated attackers, wit

• 7.5 High severity

  wpForo Forum: Missing Authorization

  CVE-2025-66070Dec 18, 2025Tomdever

  Missing Authorization vulnerability in Tomdever wpForo Forum wpforo allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects wpForo Forum: from n/a through <= 2.4.10.

• 7.5 High severity

  wpForo Forum: Improper Neutralization of Special Elements used in an SQL Command

  CVE-2025-13126Dec 14, 2025Tomdever

  The wpForo Forum plugin for WordPress is vulnerable to generic SQL Injection via the `post_args` and `topic_args` parameters in all versions up to, and including, 2.4.12 due to insufficient escaping on the user supplied parameter and lack of sufficient prepara

• 7.5 High severity

  wpForo Forum: Improper Neutralization of Special Elements used in an SQL Command

  CVE-2025-4203Oct 25, 2025Tomdever

  The wpForo Forum plugin for WordPress is vulnerable to error‐based or time-based SQL Injection via the get_members() function in all versions up to, and including, 2.4.8 due to missing integer validation on the 'offset' and 'row_count' parameters. The function

• 7.6 High severity

  wpForo Forum: Incorrect Privilege Assignment

  CVE-2025-31420Apr 4, 2025Tomdever

  Incorrect Privilege Assignment vulnerability in Tomdever wpForo Forum wpforo allows Privilege Escalation.This issue affects wpForo Forum: from n/a through <= 2.4.2.

• 8.8 High severity

  wpForo Forum: Inclusion of Functionality from Untrusted Control Sphere

  CVE-2023-2249Jun 9, 2023TomdeverEPSS 60.8%

  The wpForo Forum plugin for WordPress is vulnerable to Local File Include, Server-Side Request Forgery, and PHAR Deserialization in versions up to, and including, 2.1.7. This is due to the insecure use of file_get_contents without appropriate verification of t