CVE-2026-28559CWE-200

wpForo Forum 2.4.14 Information Disclosure via Global RSS Feed

Medium · published February 28, 2026

CVSS v4.0
6.9
EPSS
0%
Percentile
41.5
In the wild
Unconfirmed
What it is

wpForo Forum 2.4.14 contains an information disclosure vulnerability that allows unauthenticated users to retrieve private and unapproved forum topics via the global RSS feed endpoint. Attackers request the RSS feed without a forum ID parameter, bypassing the privacy and status WHERE clauses that are only applied when a specific forum ID is present in the query.

The record
Technical detail
CVSS v4.0
6.9 · MEDIUM
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
EPSS
0.00494 · 41.5th percentile
Weakness
CWE-200 · Exposure of Sensitive Information to an Unauthorized Actor
Published
2026-02-28T21:47Z
EPSS history
Timeline
  • 28 FEB 21:47Z
    wpForo Forum 2.4.14 Information Disclosure via Global RSS Feed
    cvelistv5