wpForo Forum CVE-2025-13126

No special configuration required beyond having the wpForo Forum plugin installed and active on a WordPress site (version ≤2.4.12) with forum/topic pages reachable over the network. The injection is reached through the post_args and topic_args parameters used by the Posts, Topics, RecentPosts, and RecentTopics components, which are part of normal forum display functionality, so default installations are affected. Exploitation is unauthenticated (PR:N) and requires no user interaction (UI:N). The primary limiting factor is that the site must actually run this plugin at a vulnerable version; impact is confined to data disclosure (C:H, I:N, A:N) - the flaw does not by itself enable data modification or site takeover, though extracted credentials/secrets could enable follow-on compromise.

Signals are moderately consistent and point to a credible but not emergency-level priority. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) describes network-reachable, low-complexity, unauthenticated exploitation, which drives the 7.5 HIGH score - appropriate for an unauthenticated SQL injection, though capped because impact is confidentiality-only (C:H/I:N/A:N). Against that, EPSS is low at 0.38% (29th percentile), there is no CISA KEV listing, and no public exploit was identified in the provided data, so there is no evidence of active or widespread exploitation yet. The low EPSS alongside a high CVSS is not contradictory here: it reflects that no weaponized exploit has circulated, not that the flaw is hard to reach. The Wordfence source and trac references confirm the vulnerable code paths (Posts.php, Topics.php, RecentPosts/RecentTopics widgets), which supports confidence in the finding's validity. Net assessment: a real, patch-worthy vulnerability - unauthenticated data exposure in a public-facing plugin - but current telemetry suggests opportunistic rather than mass exploitation, so treat as high-priority patching rather than active-incident response.

An unauthenticated attacker sends a crafted HTTP request to a WordPress site running wpForo Forum (≤2.4.12), supplying a malicious value in the post_args or topic_args parameter that is concatenated into an insufficiently prepared SQL query. Because the input is not properly escaped, the attacker appends additional SQL to extract sensitive data such as user credentials, email addresses, or session/secret data from the WordPress database. No public exploit code was identified at time of analysis, but the low attack complexity (AC:L) and lack of authentication (PR:N) make exploitation straightforward for a skilled attacker.