SQL Injection Vulnerability in wpForo Forum Plugin

The wpForo Forum plugin for WordPress is susceptible to an unauthenticated SQL injection vulnerability identified as CVE-2026-5097, affecting all versions up to and including 2.4.17. The vulnerability exists due to insufficient sanitization of user-supplied data within the 'referer' parameter and a lack of parameterized queries when constructing database interactions. This flaw allows remote, unauthenticated attackers to append malicious SQL payloads to legitimate database requests. Successful exploitation enables unauthorized access to the application database, potentially resulting in the exfiltration of sensitive information, including user credentials or private forum content. Defenders should prioritize updating the wpForo plugin to a patched version once available and inspect web server access logs for anomalous SQL syntax within HTTP referer headers.

Impact

The vulnerability carries a CVSS v3.1 score of 7.5, reflecting a significant risk to WordPress sites hosting forum communities. Exploitation could lead to full database compromise, unauthorized disclosure of PII, and complete exposure of private forum discussions. Given the nature of the flaw, it is accessible to unauthenticated attackers, making it a critical concern for public-facing web servers.

Recommendation

• Monitor web server logs for HTTP requests containing SQL injection patterns within the 'Referer' header.
• Audit all WordPress installations running the wpForo Forum plugin and verify current versioning.
• Update the wpForo Forum plugin to the latest version immediately upon the release of a security patch by the vendor.
• Implement or update Web Application Firewall (WAF) rules to detect and block common SQL injection signatures directed at the referer parameter.