EUVD-2026-36807
GHSA-r7jj-7q7m-56qf
Severity by source
AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L
Unauthenticated network SQLi against a WordPress plugin (PR:N, AV:N, AC:L); S:C and C:H from shared-DB exposure; I:L allowed because SQLi typically permits some data modification, A:N as no DoS path is described.
Primary rating from Vendor (Patchstack).
CVSS VectorVendor: Patchstack
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L
Lifecycle Timeline
1DescriptionCVE.org
Unauthenticated SQL Injection in wpForo Forum <= 3.0.4 versions.
AnalysisAI
Unauthenticated SQL injection in the wpForo Forum WordPress plugin (versions 3.0.4 and earlier) allows remote attackers to inject arbitrary SQL into backend database queries without any credentials or user interaction. With a CVSS 3.1 score of 9.3 and a scope-changing vector, exploitation can expose data beyond the plugin's own context, though no public exploit identified at time of analysis and the vulnerability is not currently listed in CISA KEV.
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | No special conditions - remote unauthenticated exploitation against default installations of wpForo Forum plugin versions ≤3.0.4 on WordPress, with no user interaction required (CVSS AV:N/AC:L/PR:N/UI:N). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N is maximally exposed - network-reachable, no authentication, no user interaction, low complexity - which is consistent with an unauthenticated SQLi reachable on any public WordPress site running the plugin. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An unauthenticated attacker sends a crafted HTTP request to a vulnerable wpForo endpoint (for example, a search, member-lookup, or forum-listing parameter) with SQL injection payloads, leveraging UNION-based or time-based techniques to extract data from the WordPress database. Because S:C/C:H applies, the attacker can read wp_users password hashes, wp_options secrets, and data from other plugins sharing the database - enabling subsequent offline cracking or session hijacking. … |
| Remediation | Patch available per vendor advisory - administrators should upgrade wpForo Forum to a version newer than 3.0.4 as soon as a fixed release is published by tomdever/gVectors; consult the Patchstack advisory (https://patchstack.com/database/wordpress/plugin/wpforo/vulnerability/wordpress-wpforo-forum-plugin-3-0-4-sql-injection-vulnerability) and the WordPress.org plugin page for the exact patched version. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
24 hours: Audit all WordPress installations for wpForo versions 3.0.4 and earlier; immediately disable the plugin or restrict its access via firewall rules. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More from same product – last 7 days
Share
External POC / Exploit Code
Leaving vuln.today