SQL Injection Vulnerability in wpForo Forum Plugin

CVE-2024-3200

What is CVE-2024-3200?

The wpForo Forum plugin for WordPress is exposed to an SQL Injection vulnerability that allows authenticated users with contributor-level access and above to manipulate SQL queries via the 'slug' parameter in the 'wpforo' shortcode. This vulnerability arises from insufficient escaping of user-supplied data and inadequate preparation in the SQL query. Consequently, an attacker can append additional SQL statements to existing queries, facilitating access to sensitive information stored in the database. It is imperative for users of the wpForo Forum plugin to upgrade to the latest version to mitigate this risk.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References