SQL Injection Vulnerability in wpForo Forum Plugin for WordPress

CVE-2026-119155

What is CVE-2026-119155?

The wpForo Forum plugin for WordPress is susceptible to a time-based SQL injection that affects all versions up to and including 3.2.2. The vulnerability arises from inadequate escaping of user-supplied parameters, particularly through the 'href[locale]' parameter, paired with insufficient preparation in the SQL queries. This flaw enables unauthorized attackers to inject malicious SQL commands into existing queries, potentially leading to the extraction of sensitive information from the database. The nonce necessary for exploitation is publicly accessible to any unauthenticated user visiting a forum page via the wpforo.nonces JavaScript object, eliminating the need for an account or prior interactions.

References