Time-Based SQL Injection Vulnerability in wpForo Forum Plugin for WordPress

CVE-2026-1581

What is CVE-2026-1581?

The wpForo Forum plugin for WordPress contains a significant SQL Injection vulnerability that stems from inadequate escaping of user-provided parameters via the 'wpfob' parameter. This flaw affects all versions up to and including 2.4.14. An unauthenticated attacker can exploit this vulnerability to embed their own SQL queries into existing ones, potentially allowing them access to sensitive data stored in the database. Effective remediation includes updating to the latest version of the plugin, which addresses these security concerns.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References