{"id":"CVE-2026-119155","kind":"vulnerability","aliases":["CVE-2026-119155"],"related":[],"title":"wpForo Forum WordPress plugin: SQL injection lets visitors read the database","description":"The wpForo Forum plugin for WordPress is vulnerable to time-based SQL Injection via the 'href[locale]' parameter in all versions up to, and including, 3.2.2 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. The nonce required for exploitation is publicly issued to unauthenticated visitors on any forum page via the wpforo.nonces JavaScript object, meaning no account or prior interaction beyond a page load is required to obtain it.","summary":"The wpForo Forum plugin for WordPress is vulnerable to time-based SQL injection through the 'href[locale]' parameter in all versions up to and including 3.2.2. An unauthenticated attacker can append SQL queries to existing ones and extract sensitive information from the site's database.","severity":"high","cvss":7.5,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"wpforo","fixed":["3.2.3"],"affected":"<= 3.2.2","ecosystem":"wordpress"}],"ecosystems":[],"tags":["runtime","self-hosted","unauthenticated","wordpress","wpforo"],"not_affected_if":["newer-version","plugin-not-installed"],"how_to_check":"In WordPress admin go to Plugins and read the wpForo Forum version; 3.2.2 or lower is vulnerable. Or check the Version header in wp-content/plugins/wpforo/wpforo.php. Fixed in 3.2.3.","fix":"Update the wpForo Forum plugin to 3.2.3 or newer (per Wordfence; not yet confirmed on the vendor's changelog).","status":"open","published_at":"2026-11-07T10:17:07+00:00","first_seen_at":"2026-11-07T10:46:40+00:00","triaged_at":"2026-11-07T10:48:24+00:00","updated_at":"2026-11-07T10:50:35+00:00","category":"runtime","confidence":0.8,"triage":{"at":"2026-11-07T10:48:24Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"wpForo Forum WordPress plugin: SQL injection lets visitors read the database","impact":"high","summary":"The wpForo Forum plugin for WordPress is vulnerable to time-based SQL injection through the 'href[locale]' parameter in all versions up to and including 3.2.2. An unauthenticated attacker can append SQL queries to existing ones and extract sensitive information from the site's database.","audience":"businesses","category":"runtime","nicknames":[],"who_cares":["wordpress","wpforo","self-hosted"],"confidence":0.7,"fix_status":"unknown","needs_auth":"no","worst_case":"database contents readable by unauthenticated visitors, including sensitive data","analyst_note":"Find the fixed wpForo version after 3.2.2 in the plugin's changelog or the NVD/WPScan entry for CVE-2026-119155.","how_to_check":"- Check the installed wpForo version in the WordPress admin under Plugins, or in the plugin's main file header.\n- Look for the `wpforo` plugin directory under `wp-content/plugins/`.","plain_action":"","needs_analyst":true,"not_affected_if":["plugin-not-installed","newer-version"],"who_is_affected":"Any WordPress site running the wpForo Forum plugin at version 3.2.2 or earlier is exposed. The attack needs only a page load on a forum page to obtain the nonce that the exploit requires, so no account is needed. Sites that do not run wpForo are not affected.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.00072,"input_tokens":4354,"output_tokens":569,"severity_before":"high"},"analyst_status":"done","analyst_note":"Find the fixed wpForo version after 3.2.2 in the plugin's changelog or the NVD/WPScan entry for CVE-2026-119155.","search":"'-119155':14A,17A '-2026':13A,16A '3.2.2':52B,98C 'account':167C 'addit':127C 'alreadi':131C 'append':57B,126C 'attack':55B,124C 'base':37B,83C 'beyond':171C 'cve':12A,15A 'databas':11A,71B,144C 'due':99C 'escap':102C 'exist':61B,115C,132C 'exploit':149C 'extract':64B,139C 'forum':2A,28B,74C,158C 'host':22B 'href':42B,88C 'includ':51B,97C 'inform':66B,141C 'inject':6A,39B,85C 'insuffici':101C 'interact':170C 'issu':152C 'javascript':163C 'lack':109C 'let':7A 'load':174C 'local':43B,89C 'make':119C 'mean':165C 'nonc':146C 'object':164C 'obtain':178C 'one':62B 'page':159C,173C 'paramet':44B,90C,107C 'plugin':4A,29B,75C 'possibl':121C 'prepar':112C 'prior':169C 'public':151C 'queri':59B,117C,129C,133C 'read':9A 'requir':147C,176C 'runtim':19B 'self':21B 'self-host':20B 'sensit':65B,140C 'site':69B 'sql':5A,38B,58B,84C,116C,128C 'suffici':111C 'suppli':106C 'time':36B,82C 'time-bas':35B,81C 'unauthent':23B,54B,123C,154C 'use':137C 'user':105C 'version':47B,93C 'via':86C,160C 'visitor':8A,155C 'vulner':33B,79C 'wordpress':3A,24B,31B,77C 'wpforo':1A,18A,25B,27B,73C 'wpforo.nonces':162C","nicknames":[],"mitigations":[],"who_affected":"Any WordPress site running the wpForo Forum plugin at version 3.2.2 or earlier. The flaw is in the 'href[locale]' parameter and needs no login: the nonce needed is published to every visitor in the wpforo.nonces JavaScript object on any forum page. An attacker can read database contents (time-based SQL injection). Sites without wpForo, or already on 3.2.3+, can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":["wpforo"],"ptokens":["wpforo"],"labels":["high","runtime","selfhosted","unauthenticated","wordpress","wpforo"],"campaign_type":null,"search_a":"'-119155':14A,17A '-2026':13A,16A 'cve':12A,15A 'databas':11A 'forum':2A 'inject':6A 'let':7A 'plugin':4A 'read':9A 'sql':5A 'visitor':8A 'wordpress':3A 'wpforo':1A,18A","search_b":"'3.2.2':52B 'append':57B 'attack':55B 'base':37B 'databas':71B 'exist':61B 'extract':64B 'forum':28B 'host':22B 'href':42B 'includ':51B 'inform':66B 'inject':39B 'local':43B 'one':62B 'paramet':44B 'plugin':29B 'queri':59B 'runtim':19B 'self':21B 'self-host':20B 'sensit':65B 'site':69B 'sql':38B,58B 'time':36B 'time-bas':35B 'unauthent':23B,54B 'version':47B 'vulner':33B 'wordpress':24B,31B 'wpforo':25B,27B","search_c":"'3.2.2':98C 'account':167C 'addit':127C 'alreadi':131C 'append':126C 'attack':124C 'base':83C 'beyond':171C 'databas':144C 'due':99C 'escap':102C 'exist':115C,132C 'exploit':149C 'extract':139C 'forum':74C,158C 'href':88C 'includ':97C 'inform':141C 'inject':85C 'insuffici':101C 'interact':170C 'issu':152C 'javascript':163C 'lack':109C 'load':174C 'local':89C 'make':119C 'mean':165C 'nonc':146C 'object':164C 'obtain':178C 'page':159C,173C 'paramet':90C,107C 'plugin':75C 'possibl':121C 'prepar':112C 'prior':169C 'public':151C 'queri':117C,129C,133C 'requir':147C,176C 'sensit':140C 'sql':84C,116C,128C 'suffici':111C 'suppli':106C 'time':82C 'time-bas':81C 'unauthent':123C,154C 'use':137C 'user':105C 'version':93C 'via':86C,160C 'visitor':155C 'vulner':79C 'wordpress':77C 'wpforo':73C 'wpforo.nonces':162C","first_public_at":"2026-11-07T10:17:07+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","cvss_by":"security@wordfence.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-119155","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-119155","severity":null,"published_at":"2026-11-07T10:17:07+00:00","modified_at":"2026-11-07T10:17:07+00:00","first_seen_at":"2026-11-07T10:46:40+00:00","fetched_at":"2026-11-07T10:46:40+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-119155:2102","url":"https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/wpforo/wpforo-forum-322-unauthenticated-sql-injection-via-hreflocale-parameter","severity":null,"published_at":"2026-11-07T10:50:35+00:00","modified_at":"2026-11-07T10:50:35+00:00","first_seen_at":"2026-11-07T10:50:35+00:00","fetched_at":"2026-11-07T10:50:35+00:00","note":"Wordfence advisory (CVSS 7.5, researcher UKO, published 2026-11-06): affected <= 3.2.2, patched 3.2.3. No exploitation or PoC reported in sources. Nothing marked verified: Wordfence is a third-party source; vendor changelog/trac not read. Sibling wpForo CVEs exist (CVE-2026-95870, -119164, -120532, -110004), all fixed in the same release train; 3.2.3 fix version applies here only per Wordfence.","cites":["https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/wpforo/wpforo-forum-322-unauthenticated-sql-injection-via-hreflocale-parameter","https://wordpress.org/plugins/wpforo/"]}],"documents":[{"id":94912,"url":"https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/wpforo/wpforo-forum-322-unauthenticated-sql-injection-via-hreflocale-parameter","title":"Wordfence: wpForo Forum <= 3.2.2 Unauthenticated SQL Injection via href[locale]","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":94906,"url":"https://wordpress.org/plugins/wpforo/","title":"wpForo Forum plugin page (WordPress.org)","kind":"vendor","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"describes","confidence":null,"note":null}],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}