What is the CVSS score of CVE-2026-28562?

CVE-2026-28562 has a CVSS 3.1 base score of 8.2 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N. EPSS exploitation probability: 0.0%.

Which versions of Wpforo Forum are affected by CVE-2026-28562?

wpForo 2.4.14 deployments are exposed to unauthenticated SQL injection attacks that could allow attackers to extract sensitive data, modify database records, or achieve remote code execution without…

How to fix or mitigate CVE-2026-28562?

Within 24 hours: Identify all wpForo 2.4.14 instances in your environment and restrict network access to administration interfaces. Within 7 days: Deploy WAF rules to block malicious ORDER BY clause patterns and implement database activity monitoring. Within 30 days: Monitor vendor security advisories closely and prepare immediate upgrade procedures; contact wpForo for patch availability timeline or consider alternative forum solutions if patch delays extend beyond 60 days.

Wpforo Forum CVE-2026-28562

HIGH

SQL Injection (CWE-89)

2026-02-28 disclosure@vulncheck.com

WordPress SQLi Wpforo Forum

8.2

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.2 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Mar 12, 2026 - 21:55 vuln.today

CVE Published

Feb 28, 2026 - 22:16 nvd

HIGH 8.2

DescriptionCVE.org

wpForo 2.4.14 contains an unauthenticated SQL injection vulnerability in Topics::get_topics() where the ORDER BY clause relies on ineffective esc_sql() sanitization on unquoted identifiers. Attackers exploit the wpfob parameter with CASE WHEN payloads to perform blind boolean extraction of credentials from the WordPress database.

AnalysisAI

Unauthenticated SQL injection in wpForo 2.4.14 allows remote attackers to extract sensitive data from WordPress databases through the wpfob parameter via blind boolean-based attacks. The vulnerability exploits inadequate sanitization of ORDER BY clause identifiers, enabling credential theft without authentication. No patch is currently available for affected installations.

Technical ContextAI

Classified as CWE-89 (SQL Injection). Affects Wpforo Forum. wpForo 2.4.14 contains an unauthenticated SQL injection vulnerability in Topics::get_topics() where the ORDER BY clause relies on ineffective esc_sql() sanitization on unquoted identifiers. Attackers exploit the wpfob parameter with CASE WHEN payloads to perform blind boolean extraction of credentials from the WordPress database.

RemediationAI

Monitor vendor advisories for a patch. Use parameterized queries. Implement input validation. Restrict network access to the affected service where possible.