WordPress security by component

wpForo Forum

Plugin description

wpForo Forum adds discussion forums to WordPress with topics, replies, user profiles, categories, and forum management features.

wpForo Forum (wpforo) is a WordPress plugin with 48 published CVE records in this archive. The latest tracked vulnerability was published Aug 28, 2026; the highest published CVSS base score is 9.9.

Plugin slug: wpforo

Latest vulnerability

CVE-2026-5097: wpForo referer handling permits unauthenticated SQL injection

wpForo Forum through 2.4.17 does not adequately escape or prepare the user-controlled referer parameter before using it in an SQL query. An unauthenticated attacker can append SQL and extract sensitive database information.

PublishedAug 28, 2026

Safe version guidanceSee mitigation notes

Published vulnerabilities for wpforo
		Safe version
Aug 28, 2026	CVE-2026-5097 wpForo referer handling permits unauthenticated SQL injection wpForo Forum through 2.4.17 does not adequately escape or prepare the user-controlled referer parameter before using it in an SQL query. An unauthenticated attacker can append SQL and extract sensitive database information.	See mitigation notes	CVE7.5 NVDPending
Jul 16, 2026	CVE-2026-15021 wpForo Forum: Cross-site scripting wpForo Forum is affected by cross-site scripting. Exploitation requires an authenticated subscriber account. Injected script can execute in the affected site's origin when the vulnerable output is viewed. The published affected range is <= 3.1.1.	See mitigation notes	CVE6.4 NVDPending
Jun 26, 2026	CVE-2026-57636 wpForo Forum: SQL injection wpForo Forum is affected by SQL injection. Exploitation requires an authenticated contributor account. A successful request can alter database queries and expose or modify WordPress data. The published affected range is n/a through 3.0.9.	3.1.0	CVE8.5 NVDPending
Jun 17, 2026	CVE-2026-49767 wpForo Forum: Privilege escalation or authentication bypass wpForo Forum is affected by privilege escalation or authentication bypass. The vulnerable path is reachable without authentication. A successful request can grant permissions or access that the caller should not possess. The published affected range is n/a through 3.1.0.	3.1.1	CVE9.8 NVDPending
Jun 15, 2026	CVE-2026-49769 wpForo Forum: Code execution wpForo Forum is affected by code execution. The vulnerable path is reachable without authentication. Successful exploitation can run attacker-controlled code in the WordPress hosting account. The published affected range is n/a through 3.1.0.	3.1.1	CVE9.8 NVDPending
Jun 15, 2026	CVE-2026-40798 wpForo Forum: SQL injection wpForo Forum is affected by SQL injection. The vulnerable path is reachable without authentication. A successful request can alter database queries and expose or modify WordPress data. The published affected range is n/a through 3.0.4.	3.0.5	CVE9.3 NVDPending
Jun 15, 2026	CVE-2026-40767 wpForo Forum: Broken access control wpForo Forum is affected by broken access control. The vulnerable path is reachable without authentication. A successful request can reach data or an operation that should be restricted to another user or a more privileged role. The published affected range is n/a to < 3.0.2.	3.0.2	CVE7.5 NVDPending
Jun 01, 2026	CVE-2026-42682 wpForo Forum: A security weakness wpForo Forum is affected by a security weakness. Exposure depends on how the affected operation is made reachable by the site. The resulting impact depends on how the affected component exposes the vulnerable operation. The published affected range is n/a through 3.0.6.	3.0.7	CVE9.1 NVDPending
Apr 20, 2026	CVE-2026-6248 wpForo Forum: Code execution wpForo Forum is affected by code execution. Exploitation requires an authenticated subscriber account. Successful exploitation can run attacker-controlled code in the WordPress hosting account. The published affected range is <= 3.0.5.	See mitigation notes	CVE8.1 NVDPending
Apr 17, 2026	CVE-2026-4666 wpForo Forum: A security weakness wpForo Forum is affected by a security weakness. Exploitation requires an authenticated subscriber account. The resulting impact depends on how the affected component exposes the vulnerable operation. The published affected range is <= 2.4.16.	See mitigation notes	CVE6.5 NVDPending
Apr 11, 2026	CVE-2026-5809 wpForo Forum: Arbitrary file deletion wpForo Forum is affected by arbitrary file deletion. Exploitation requires an authenticated subscriber account. A successful request can remove files outside the intended scope and may make the site unavailable. The published affected range is <= 3.0.2.	See mitigation notes	CVE7.1 NVDPending
Feb 28, 2026	CVE-2026-28562 Wpforo: SQL injection Wpforo is affected by SQL injection. The vulnerable path is reachable without authentication. A successful request can alter database queries and expose or modify WordPress data.	See mitigation notes	CVE8.8 NVD9.8
Feb 28, 2026	CVE-2026-28561 Wpforo: Cross-site scripting Wpforo is affected by cross-site scripting. Exposure depends on how the affected operation is made reachable by the site. Injected script can execute in the affected site's origin when the vulnerable output is viewed.	See mitigation notes	CVE4.8 NVD4.8
Feb 28, 2026	CVE-2026-28560 Wpforo: Cross-site scripting Wpforo is affected by cross-site scripting. Exposure depends on how the affected operation is made reachable by the site. Injected script can execute in the affected site's origin when the vulnerable output is viewed.	See mitigation notes	CVE4.8 NVD4.8
Feb 28, 2026	CVE-2026-28559 Wpforo: Sensitive information exposure Wpforo is affected by sensitive information exposure. The vulnerable path is reachable without authentication. Successful exploitation can disclose data that should not be available to the caller.	See mitigation notes	CVE6.9 NVDPending
Feb 28, 2026	CVE-2026-28558 Wpforo: Cross-site scripting Wpforo is affected by cross-site scripting. Exposure depends on how the affected operation is made reachable by the site. Injected script can execute in the affected site's origin when the vulnerable output is viewed.	See mitigation notes	CVE5.1 NVD5.4
Feb 28, 2026	CVE-2026-28557 Wpforo: A security weakness Wpforo is affected by a security weakness. Exposure depends on how the affected operation is made reachable by the site. The resulting impact depends on how the affected component exposes the vulnerable operation.	See mitigation notes	CVE7.1 NVDPending
Feb 28, 2026	CVE-2026-28556 Wpforo: A security weakness Wpforo is affected by a security weakness. Exposure depends on how the affected operation is made reachable by the site. The resulting impact depends on how the affected component exposes the vulnerable operation.	See mitigation notes	CVE5.3 NVD5.4
Feb 28, 2026	CVE-2026-28555 Wpforo: A security weakness Wpforo is affected by a security weakness. Exposure depends on how the affected operation is made reachable by the site. The resulting impact depends on how the affected component exposes the vulnerable operation.	See mitigation notes	CVE5.3 NVDPending
Feb 28, 2026	CVE-2026-28554 Wpforo: A security weakness Wpforo is affected by a security weakness. Exposure depends on how the affected operation is made reachable by the site. The resulting impact depends on how the affected component exposes the vulnerable operation.	See mitigation notes	CVE5.3 NVDPending
Feb 19, 2026	CVE-2026-1581 wpForo Forum: SQL injection wpForo Forum is affected by SQL injection. The vulnerable path is reachable without authentication. A successful request can alter database queries and expose or modify WordPress data.	See mitigation notes	CVE7.5 NVDPending
Feb 11, 2026	CVE-2026-0910 wpForo Forum: Code execution wpForo Forum is affected by code execution. Exploitation requires an authenticated subscriber account. Successful exploitation can run attacker-controlled code in the WordPress hosting account.	See mitigation notes	CVE8.8 NVDPending
Dec 18, 2025	CVE-2025-66070 wpForo Forum: A security weakness wpForo Forum is affected by a security weakness. Exposure depends on how the affected operation is made reachable by the site. The resulting impact depends on how the affected component exposes the vulnerable operation.	See mitigation notes	CVE7.5 NVDPending
Dec 14, 2025	CVE-2025-13126 wpForo Forum: SQL injection wpForo Forum is affected by SQL injection. The vulnerable path is reachable without authentication. A successful request can alter database queries and expose or modify WordPress data.	See mitigation notes	CVE7.5 NVDPending
Oct 25, 2025	CVE-2025-4203 wpForo Forum: SQL injection wpForo Forum is affected by SQL injection. The vulnerable path is reachable without authentication. A successful request can alter database queries and expose or modify WordPress data.	See mitigation notes	CVE7.5 NVDPending
Sep 03, 2025	CVE-2025-58597 wpForo Forum: A security weakness wpForo Forum is affected by a security weakness. Exposure depends on how the affected operation is made reachable by the site. The resulting impact depends on how the affected component exposes the vulnerable operation.	See mitigation notes	CVE4.3 NVDPending
Jul 10, 2025	CVE-2025-4406 wpForo Forum: Cross-site scripting wpForo Forum is affected by cross-site scripting. Exploitation requires an authenticated subscriber account. Injected script can execute in the affected site's origin when the vulnerable output is viewed.	See mitigation notes	CVE5.4 NVDPending
Apr 04, 2025	CVE-2025-31420 wpForo Forum: Privilege escalation or authentication bypass wpForo Forum is affected by privilege escalation or authentication bypass. Exposure depends on how the affected operation is made reachable by the site. A successful request can grant permissions or access that the caller should not possess.	See mitigation notes	CVE7.6 NVDPending
Aug 26, 2024	CVE-2024-43289 wpForo Forum: A security weakness wpForo Forum is affected by a security weakness. Exposure depends on how the affected operation is made reachable by the site. The resulting impact depends on how the affected component exposes the vulnerable operation.	See mitigation notes	CVE7.5 NVD7.5
Aug 18, 2024	CVE-2024-43288 wpForo Forum: A security weakness wpForo Forum is affected by a security weakness. Exposure depends on how the affected operation is made reachable by the site. The resulting impact depends on how the affected component exposes the vulnerable operation.	See mitigation notes	CVE4.3 NVD8.1
Jun 21, 2024	CVE-2022-38055 wpForo Forum: Cross-site scripting wpForo Forum is affected by cross-site scripting. Exposure depends on how the affected operation is made reachable by the site. Injected script can execute in the affected site's origin when the vulnerable output is viewed.	See mitigation notes	CVE4.3 NVD5.4
May 17, 2024	CVE-2023-47868 wpForo Forum: Privilege escalation or authentication bypass wpForo Forum is affected by privilege escalation or authentication bypass. Exposure depends on how the affected operation is made reachable by the site. A successful request can grant permissions or access that the caller should not possess.	See mitigation notes	CVE7.3 NVD9.8
Nov 30, 2023	CVE-2023-47870 wpForo Forum: Cross-site request forgery wpForo Forum is affected by cross-site request forgery. Exposure depends on how the affected operation is made reachable by the site. Exploitation relies on a signed-in privileged user submitting an attacker-controlled request.	See mitigation notes	CVE5.7 NVD8.8
Nov 30, 2023	CVE-2023-47872 wpForo Forum: Cross-site scripting wpForo Forum is affected by cross-site scripting. Exposure depends on how the affected operation is made reachable by the site. Injected script can execute in the affected site's origin when the vulnerable output is viewed.	See mitigation notes	CVE6.5 NVD5.4
Jun 09, 2023	CVE-2023-2249 wpForo Forum: Code execution wpForo Forum is affected by code execution. Exploitation requires an authenticated WordPress account. Successful exploitation can run attacker-controlled code in the WordPress hosting account.	See mitigation notes	CVE8.8 NVD8.8
Nov 17, 2022	CVE-2022-40200 Wpforo: Dangerous file upload Wpforo is affected by dangerous file upload. Exposure depends on how the affected operation is made reachable by the site. Successful exploitation can place attacker-controlled executable content on the server and may lead to full site compromise.	See mitigation notes	CVE9.9 NVD8.8
Nov 17, 2022	CVE-2022-40192 Wpforo: Cross-site request forgery Wpforo is affected by cross-site request forgery. Exposure depends on how the affected operation is made reachable by the site. Exploitation relies on a signed-in privileged user submitting an attacker-controlled request.	See mitigation notes	CVE7.1 NVD8.8
Nov 08, 2022	CVE-2022-40632 Wpforo: Cross-site request forgery Wpforo is affected by cross-site request forgery. Exposure depends on how the affected operation is made reachable by the site. Exploitation relies on a signed-in privileged user submitting an attacker-controlled request.	See mitigation notes	CVE5.4 NVD5.4
Nov 08, 2022	CVE-2022-40206 Wpforo: Broken access control Wpforo is affected by broken access control. Exploitation requires an authenticated subscriber account. A successful request can reach data or an operation that should be restricted to another user or a more privileged role.	See mitigation notes	CVE6.3 NVD4.3
Nov 08, 2022	CVE-2022-40205 Wpforo: Broken access control Wpforo is affected by broken access control. Exploitation requires an authenticated subscriber account. A successful request can reach data or an operation that should be restricted to another user or a more privileged role.	See mitigation notes	CVE5.4 NVD4.3
Sep 09, 2022	CVE-2022-38144 Wpforo: Cross-site request forgery Wpforo is affected by cross-site request forgery. Exposure depends on how the affected operation is made reachable by the site. Exploitation relies on a signed-in privileged user submitting an attacker-controlled request.	See mitigation notes	CVE8.8 NVD8.8
Jun 15, 2020	CVE-2019-19112 Wpforo: Cross-site scripting Wpforo is affected by cross-site scripting. Exposure depends on how the affected operation is made reachable by the site. Injected script can execute in the affected site's origin when the vulnerable output is viewed.	See mitigation notes	CVEPending NVD6.1
Jun 15, 2020	CVE-2019-19111 Wpforo: Cross-site scripting Wpforo is affected by cross-site scripting. Exposure depends on how the affected operation is made reachable by the site. Injected script can execute in the affected site's origin when the vulnerable output is viewed.	See mitigation notes	CVEPending NVD6.1
Jun 15, 2020	CVE-2019-19110 Wpforo: Cross-site scripting Wpforo is affected by cross-site scripting. Exposure depends on how the affected operation is made reachable by the site. Injected script can execute in the affected site's origin when the vulnerable output is viewed.	See mitigation notes	CVEPending NVD4.8
Jun 15, 2020	CVE-2019-19109 Wpforo: Cross-site request forgery Wpforo is affected by cross-site request forgery. Exposure depends on how the affected operation is made reachable by the site. Exploitation relies on a signed-in privileged user submitting an attacker-controlled request.	See mitigation notes	CVEPending NVD8.8
Jun 19, 2019	CVE-2018-16613 Wpforo: A security weakness Wpforo is affected by a security weakness. Exposure depends on how the affected operation is made reachable by the site. The resulting impact depends on how the affected component exposes the vulnerable operation.	See mitigation notes	CVEPending NVD9.8
Jun 04, 2018	CVE-2018-11709 Wpforo: Cross-site scripting Wpforo is affected by cross-site scripting. The vulnerable path is reachable without authentication. Injected script can execute in the affected site's origin when the vulnerable output is viewed.	See mitigation notes	CVEPending NVD6.1
May 28, 2018	CVE-2018-11515 Wpforo: SQL injection Wpforo is affected by SQL injection. Exposure depends on how the affected operation is made reachable by the site. A successful request can alter database queries and expose or modify WordPress data.	See mitigation notes	CVEPending NVD9.8

Data attribution: This product uses the NVD API but is not endorsed or certified by the NVD.

Vulnerability data licensing

CVE. Copyright © 1999–2026, The MITRE Corporation. MITRE hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute Common Vulnerabilities and Exposures (CVE™). Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy.

CWE. Copyright © 2006–2026, The MITRE Corporation. CWE™ is free to use by any organization or individual for any research, development, and/or commercial purposes, per these CWE Terms of Use. Accordingly, The MITRE Corporation hereby grants you a non-exclusive, royalty-free license to use CWE for research, development, and commercial purposes. Any copy you make for such purposes is authorized on the condition that you reproduce MITRE’s copyright designation and this license in any such copy.

CVSS. CVSS is owned and managed by FIRST.Org, Inc. (FIRST) and used by permission.

Source-record text is CVE/CNA content delivered through the NVD API. Fused summaries and remediation guidance are independently authored and are not attributed to NVD.

All other copyrights and trademarks are the property of their respective owners.

Full data sources, terms, and disclaimers