What is the CVSS score of CVE-2026-40798?

CVE-2026-40798 has a CVSS 3.1 base score of 9.3 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L. EPSS exploitation probability: 0.3%.

Which versions of wpForo Forum are affected by CVE-2026-40798?

The wpForo Forum WordPress plugin (versions 3.0.4 and earlier) contains a critical SQL injection vulnerability (CVE-2026-40798, CVSS 9.3) that allows unauthenticated attackers to extract sensitive…

How to fix or mitigate CVE-2026-40798?

24 hours: Audit all WordPress installations for wpForo versions 3.0.4 and earlier; immediately disable the plugin or restrict its access via firewall rules. 7 days: Contact wpForo vendor for patch availability and timeline; evaluate alternative forum plugins or migration options. 30 days: Deploy patched version or approved alternative once available; conduct database activity logs for evidence of exploitation.

wpForo Forum CVE-2026-40798

EUVD-2026-36807 CRITICAL

SQL Injection (CWE-89)

2026-06-15 Patchstack

GHSA-r7jj-7q7m-56qf

SQLi Wpforo Forum

9.3

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

9.3 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L

vuln.today AI

9.3 CRITICAL

Unauthenticated network SQLi against a WordPress plugin (PR:N, AV:N, AC:L); S:C and C:H from shared-DB exposure; I:L allowed because SQLi typically permits some data modification, A:N as no DoS path is described.

3.1 AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:H/SI:L/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

None

Availability

Low

Lifecycle Timeline

Analysis Generated

Jun 15, 2026 - 22:05 vuln.today

DescriptionCVE.org

Unauthenticated SQL Injection in wpForo Forum <= 3.0.4 versions.

AnalysisAI

Unauthenticated SQL injection in the wpForo Forum WordPress plugin (versions 3.0.4 and earlier) allows remote attackers to inject arbitrary SQL into backend database queries without any credentials or user interaction. With a CVSS 3.1 score of 9.3 and a scope-changing vector, exploitation can expose data beyond the plugin's own context, though no public exploit identified at time of analysis and the vulnerability is not currently listed in CISA KEV.

Technical ContextAI

wpForo Forum is a popular WordPress forum plugin developed by tomdever (gVectors Team), commonly used to add full-featured discussion boards to WordPress sites. The root cause class is CWE-89 (Improper Neutralization of Special Elements used in an SQL Command), meaning user-controllable input is concatenated or interpolated into SQL queries without proper parameterization or escaping via WordPress's $wpdb->prepare() API. The affected CPE cpe:2.3:a:tomdever:wpforo_forum covers all versions up to and including 3.0.4, indicating the injection point exists in code paths reachable without authentication - typically forum search, listing, or AJAX handlers exposed to anonymous visitors.

RemediationAI

Patch available per vendor advisory - administrators should upgrade wpForo Forum to a version newer than 3.0.4 as soon as a fixed release is published by tomdever/gVectors; consult the Patchstack advisory (https://patchstack.com/database/wordpress/plugin/wpforo/vulnerability/wordpress-wpforo-forum-plugin-3-0-4-sql-injection-vulnerability) and the WordPress.org plugin page for the exact patched version. Until upgrading, compensating controls include placing the WordPress site behind a WAF with SQLi signatures enabled (Patchstack, Wordfence, Cloudflare managed rules) - note that virtual patching may miss obfuscated payloads - or temporarily deactivating the wpForo plugin, which removes forum functionality entirely. Restricting access to wpForo endpoints (forum, member, and admin-ajax actions registered by the plugin) via IP allowlisting at the web server is another option but breaks public forum participation, and rotating WordPress secrets (AUTH_KEY, etc.) and forcing password resets is advisable after patching given the C:H impact on the shared database.