Skip to main content

Wpforo Forum CVE-2026-28555

MEDIUM
Missing Authorization (CWE-862)
2026-02-28 disclosure@vulncheck.com
Authentication Bypass Wpforo Forum
4.3
CVSS 3.1 · NVD
Share

Severity by source

NVD PRIMARY
4.3 MEDIUM
AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
Low
Availability
None

Lifecycle Timeline

2
Analysis Generated
Mar 12, 2026 - 21:55 vuln.today
CVE Published
Feb 28, 2026 - 22:16 nvd
MEDIUM 4.3

DescriptionCVE.org

wpForo Forum 2.4.14 contains a missing authorization vulnerability that allows authenticated subscribers to close or reopen any forum topic via the wpforo_close_ajax handler. Attackers submit a valid nonce with an arbitrary topic ID to bypass the moderator permission requirement and disrupt forum discussions.

AnalysisAI

Authenticated users in wpForo Forum 2.4.14 can manipulate forum topic states by exploiting improper authorization checks in the wpforo_close_ajax handler, allowing them to close or reopen discussions they should not have permission to modify. An attacker with subscriber privileges can craft requests with valid nonces to bypass moderator permission validation and disrupt forum operations. No patch is currently available for this vulnerability.

Technical ContextAI

Classified as CWE-862 (Missing Authorization). Affects the wpforo_close_ajax component of Wpforo Forum. wpForo Forum 2.4.14 contains a missing authorization vulnerability that allows authenticated subscribers to close or reopen any forum topic via the wpforo_close_ajax handler. Attackers submit a valid nonce with an arbitrary topic ID to bypass the moderator permission requirement and disrupt forum discussions.

RemediationAI

Monitor vendor advisories for a patch. Restrict network access to the affected service where possible.

More in Wpforo Forum

View all
CVE-2023-2249 HIGH
8.8 Jun 09

The wpForo Forum plugin for WordPress is vulnerable to Local File Include, Server-Side Request Forgery, and PHAR Deseria
CVE-2024-3200 CRITICAL
9.9 Jun 01

The wpForo Forum plugin for WordPress is vulnerable to SQL Injection via the 'slug' attribute of the 'wpforo' shortcode

CVE-2023-2309 MEDIUM POC
6.1 Jul 24

The wpForo Forum WordPress plugin before 2.1.9 does not escape some request parameters while in debug mode, leading to a
CVE-2021-24406 MEDIUM POC
6.1 Jul 06

The wpForo Forum WordPress plugin before 1.9.7 did not validate the redirect_to parameter in the login form of the forum
CVE-2018-11709 MEDIUM POC
6.1 Jun 04

wpforo_get_request_uri in wpf-includes/functions.php in the wpForo Forum plugin before 1.4.12 for WordPress allows Unaut
CVE-2026-49769 CRITICAL
9.8 Jun 15

Unauthenticated PHP Object Injection in the wpForo Forum WordPress plugin versions 3.1.0 and earlier allows remote attac
CVE-2026-49767 CRITICAL
9.8 Jun 17

Authentication bypass in the wpForo Forum WordPress plugin versions 3.1.0 and earlier allows remote unauthenticated atta
CVE-2026-12696 MEDIUM POC
5.4 Aug 01

Stored cross-site scripting in wpForo Forum WordPress plugin before 3.1.2 allows a subscriber-level authenticated user t
CVE-2026-12697 MEDIUM POC
5.4 Jul 31

Insecure Direct Object Reference (IDOR) in the wpForo Forum WordPress plugin before 3.1.2 allows any subscriber-level au
CVE-2026-40798 CRITICAL
9.3 Jun 15

Unauthenticated SQL injection in the wpForo Forum WordPress plugin (versions 3.0.4 and earlier) allows remote attackers

CVE-2026-3666 HIGH
8.8 Apr 04

Arbitrary file deletion in wpForo Forum WordPress plugin versions ≤2.4.16 allows authenticated attackers with subscriber
CVE-2022-40200 HIGH
8.8 Nov 17

Auth. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch

Same weakness CWE-862 – Missing Authorization

View all
CVE-2023-52163 HIGH POC
8.8
CVE-2025-6205 CRITICAL POC
9.1
CVE-2025-20362 HIGH POC
8.6
CVE-2017-9232 CRITICAL POC
9.8
CVE-2023-6875 CRITICAL POC
9.8
CVE-2024-4898 CRITICAL POC
9.8
CVE-2023-32117 CRITICAL POC
9.8
CVE-2020-36719 CRITICAL POC
9.8

Same technique Authentication Bypass

View all
CVE-2023-22515 CRITICAL POC
9.8
CVE-2012-4681 CRITICAL POC
9.8
CVE-2013-2465 CRITICAL POC
9.8
CVE-2011-3544 CRITICAL POC
9.8
CVE-2022-40684 CRITICAL POC
9.8
CVE-2025-61882 CRITICAL POC
9.8
CVE-2024-0012 CRITICAL POC
9.3
CVE-2023-46805 HIGH POC
8.2

Share

CVE-2026-28555 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy