CVE-2026-28562CWE-89

wpForo Forum 2.4.14 SQL Injection via Topics ORDER BY Parameter

High · published February 28, 2026

CVSS v4.0
8.8
EPSS
1%
Percentile
43.8
In the wild
Unconfirmed
What it is

wpForo 2.4.14 contains an unauthenticated SQL injection vulnerability in Topics::get_topics() where the ORDER BY clause relies on ineffective esc_sql() sanitization on unquoted identifiers. Attackers exploit the wpfob parameter with CASE WHEN payloads to perform blind boolean extraction of credentials from the WordPress database.

The record
Technical detail
CVSS v4.0
8.8 · HIGH
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N
EPSS
0.00527 · 43.8th percentile
Weakness
CWE-89 · Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Published
2026-02-28T21:47Z
EPSS history
Timeline
  • 28 FEB 21:47Z
    wpForo Forum 2.4.14 SQL Injection via Topics ORDER BY Parameter
    cvelistv5