SQL Injection Vulnerability in wpForo Forum Plugin for WordPress

CVE-2025-13126

What is CVE-2025-13126?

The wpForo Forum plugin for WordPress is susceptible to a SQL Injection vulnerability due to inadequate input sanitization on user-provided parameters 'post_args' and 'topic_args'. This weakness allows unauthenticated attackers to inject arbitrary SQL code into existing queries, potentially compromising sensitive data within the database. All versions of the plugin up to and including 2.4.12 are at risk, emphasizing the need for immediate updates and security measures to safeguard WordPress sites.

References