WPFORO · CVE-2026-95870 · Package
FIX → 3.2.2
The wpForo Forum plugin for WordPress passes the 'data' parameter into SQL queries without proper escaping or preparation, up to and including version 3.2.1. An unauthenticated attacker can append SQL to existing queries and extract sensitive data from the site's database.
first public Nov 7, 2026 · 2 sources
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
WordPress sites running the wpForo Forum plugin version 3.2.1 or older. An unauthenticated visitor can send a crafted 'data' parameter and read database contents, but only when the forum has a searchable topic form field of type checkbox, or a select/autocomplete field with isMultiChoice enabled. Sites without wpForo, or without such a field, are not exposed through this path.
Not affected if no-multichoice-search-field, no-searchable-checkbox-or-multichoice-field, plugin-above-3.2.1, plugin-not-installed, wpforo-3.2.2-or-later
Who cares self-hosted, wordpress, wpforo
wp plugin get wpforo --field=version or see Plugins in WP admin; versions <= 3.2.1 are affectedUpgrade to 3.2.2
Update wpForo Forum to 3.2.2 or later (Wordfence, Patchstack); a separate unauthenticated SQLi CVE-2026-119155 affects <= , so take the latest release.
The wpForo Forum plugin for WordPress is vulnerable to generic SQL Injection via the 'data' parameter in all versions up to, and including, 3.2.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. Exploitation requires that a searchable topic form field of type checkbox, or a select/autocomplete field with isMultiChoice enabled, is registered in the forum configuration.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
3.2.2NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.