CVE-2026-28562
wpForo 2.4.14 contains an unauthenticated SQL injection vulnerability in Topics::get_topics() where the ORDER BY clause relies on ineffective esc_sql() sanitization on unquoted identifiers. Attackers exploit the wpfob parameter with CASE WHEN payloads to perform blind boolean extraction of credentials from the WordPress database.
Vendor
Product
CWE
Yayın Tarihi
2026-02-28 22:16:03
Güncelleme
2026-03-05 15:41:20
Source Identifier
disclosure@vulncheck.com
KEV Date Added
-