CVE-2026-28556CWE-862

wpForo Forum 2.4.14 Missing Authorization via Topic Management Form Handlers

Medium · published February 28, 2026

CVSS v4.0
5.3
EPSS
0%
Percentile
23.3
In the wild
Unconfirmed
What it is

wpForo Forum 2.4.14 contains a missing authorization vulnerability that allows authenticated subscribers to move, merge, or split any forum topic via the topic_move, topic_merge, and topic_split form action handlers. Attackers with a valid form nonce can reorganize arbitrary forum content without moderator permissions, including relocating topics to private forums.

The record
Technical detail
CVSS v4.0
5.3 · MEDIUM
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N
EPSS
0.00316 · 23.3th percentile
Weakness
CWE-862 · Missing Authorization
Published
2026-02-28T21:47Z
EPSS history
Timeline
  • 28 FEB 21:47Z
    wpForo Forum 2.4.14 Missing Authorization via Topic Management Form Handlers
    cvelistv5