---
id: "CVE-2026-119155"
page: "https://infrastack.ai/live/CVE-2026-119155"
kind: "vulnerability"
aliases: ["CVE-2026-119155"]
title: "wpForo Forum WordPress plugin: SQL injection lets visitors read the database"
severity: "high"
cvss: 7.5
epss: null
exploited: false
status: "open"
category: "runtime"
products: [{"name": "wpforo", "fixed": ["3.2.3"], "affected": "<= 3.2.2", "ecosystem": "wordpress"}]
ecosystems: []
tags: ["runtime", "self-hosted", "unauthenticated", "wordpress", "wpforo"]
not_affected_if: ["newer-version", "plugin-not-installed"]
published_at: "2026-11-07T10:17:07+00:00"
first_seen_at: "2026-11-07T10:46:40+00:00"
updated_at: "2026-11-07T10:50:35+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-119155", "first_seen_at": "2026-11-07T10:46:40+00:00"}, {"source": "analyst", "url": "https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/wpforo/wpforo-forum-322-unauthenticated-sql-injection-via-hreflocale-parameter", "first_seen_at": "2026-11-07T10:50:35+00:00", "cites": ["https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/wpforo/wpforo-forum-322-unauthenticated-sql-injection-via-hreflocale-parameter", "https://wordpress.org/plugins/wpforo/"]}]
exploit_sources: []
---

# wpForo Forum WordPress plugin: SQL injection lets visitors read the database

Link for people: https://infrastack.ai/live/CVE-2026-119155 (this .md is for agents)

The wpForo Forum plugin for WordPress is vulnerable to time-based SQL injection through the 'href[locale]' parameter in all versions up to and including 3.2.2. An unauthenticated attacker can append SQL queries to existing ones and extract sensitive information from the site's database.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- wordpress:wpforo affected <= 3.2.2 fixed 3.2.3

## How to check

In WordPress admin go to Plugins and read the wpForo Forum version; 3.2.2 or lower is vulnerable. Or check the Version header in wp-content/plugins/wpforo/wpforo.php. Fixed in 3.2.3.

## Fix

Update the wpForo Forum plugin to 3.2.3 or newer (per Wordfence; not yet confirmed on the vendor's changelog).

## Timeline

- 2026-11-07T10:46:40+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-119155
- 2026-11-07T10:50:35+00:00 analyst https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/wpforo/wpforo-forum-322-unauthenticated-sql-injection-via-hreflocale-parameter — Wordfence advisory (CVSS 7.5, researcher UKO, published 2026-11-06): affected <= 3.2.2, patched 3.2.3. No exploitation or PoC reported in sources. Nothing marked verified: Wordfence is a third-party source; vendor changelog/trac not read. Sibling wpForo CVEs exist (CVE-2026-95870, -119164, -120532, -110004), all fixed in the same release train; 3.2.3 fix version applies here only per Wordfence.

## Documents

- [advisory] Wordfence: wpForo Forum <= 3.2.2 Unauthenticated SQL Injection via href[locale] https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/wpforo/wpforo-forum-322-unauthenticated-sql-injection-via-hreflocale-parameter
- [describes] wpForo Forum plugin page (WordPress.org) https://wordpress.org/plugins/wpforo/

## From the sources

The wpForo Forum plugin for WordPress is vulnerable to time-based SQL Injection via the 'href[locale]' parameter in all versions up to, and including, 3.2.2 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. The nonce required for exploitation is publicly issued to unauthenticated visitors on any forum page via the wpforo.nonces JavaScript object, meaning no account or prior interaction beyond a page load is required to obtain it.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_