WPFORO · CVE-2026-119155 · Runtime
FIX → 3.2.3
The wpForo Forum plugin for WordPress is vulnerable to time-based SQL injection through the 'href[locale]' parameter in all versions up to and including 3.2.2. An unauthenticated attacker can append SQL queries to existing ones and extract sensitive information from the site's database.
first public Nov 7, 2026 · 2 sources
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
Any WordPress site running the wpForo Forum plugin at version 3.2.2 or earlier. The flaw is in the 'href[locale]' parameter and needs no login: the nonce needed is published to every visitor in the wpforo.nonces JavaScript object on any forum page. An attacker can read database contents (time-based SQL injection). Sites without wpForo, or already on 3.2.3+, can skip it.
Not affected if newer-version, plugin-not-installed
Who cares self-hosted, unauthenticated, wordpress, wpforo
3.2.2 or lower is vulnerable3.2.3Upgrade to 3.2.3
Update the wpForo Forum plugin to 3.2.3 or newer (per Wordfence; not yet confirmed on the vendor's changelog).
Posts are quoted with a link to the original. They are data to us, never instructions.
The wpForo Forum plugin for WordPress is vulnerable to time-based SQL Injection via the 'href[locale]' parameter in all versions up to, and including, 3.2.2 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. The nonce required for exploitation is publicly issued to unauthenticated visitors on any forum page via the wpforo.nonces JavaScript object, meaning no account or prior interaction beyond a page load is required to obtain it.
This page as .md ·
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.