SQL Injection Vulnerability in wpForo Forum Plugin for WordPress

CVE-2025-4203

What is CVE-2025-4203?

The wpForo Forum plugin for WordPress is susceptible to SQL Injection through the get_members() function. This vulnerability results from inadequate validation of the 'offset' and 'row_count' parameters, permitting unauthenticated attackers to manipulate these values. By exploiting this flaw, attackers can execute error-based or time-based SQL injection, which may allow them to extract sensitive data from the database. An essential mitigation step involves updating to version 2.4.9 or newer, which strengthens input validation and enhances overall security.

References