SQL Injection Vulnerability in wpForo Forum Plugin by WordPress
CVE-2026-28562

8.8HIGH

Key Information:

Vendor: WordPress
Status: WPforo Forum
Vendor: CVE Published:; 28 February 2026

What is CVE-2026-28562?

The wpForo Forum plugin version 2.4.14 for WordPress is susceptible to an SQL injection vulnerability found in the Topics::get_topics() method. This occurs due to the ORDER BY clause inadequately using the esc_sql() function to sanitize unquoted identifiers. Attackers can leverage the 'wpfob' parameter with crafted CASE WHEN payloads to perform unauthorized actions, including blind boolean extraction of sensitive data such as user credentials from the WordPress database.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch