{"id":"CVE-2026-95870","kind":"vulnerability","aliases":["CVE-2026-95870"],"related":[],"title":"wpForo Forum WordPress plugin: unauthenticated SQL injection leaks database contents","description":"The wpForo Forum plugin for WordPress is vulnerable to generic SQL Injection via the 'data' parameter in all versions up to, and including, 3.2.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. Exploitation requires that a searchable topic form field of type checkbox, or a select/autocomplete field with isMultiChoice enabled, is registered in the forum configuration.","summary":"The wpForo Forum plugin for WordPress passes the 'data' parameter into SQL queries without proper escaping or preparation, up to and including version 3.2.1. An unauthenticated attacker can append SQL to existing queries and extract sensitive data from the site's database.","severity":"high","cvss":7.5,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"wpforo","fixed":["3.2.2"],"affected":"<= 3.2.1","ecosystem":"wordpress"}],"ecosystems":[],"tags":["package","self-hosted","wordpress","wpforo"],"not_affected_if":["no-multichoice-search-field","no-searchable-checkbox-or-multichoice-field","plugin-above-3.2.1","plugin-not-installed","wpforo-3.2.2-or-later"],"how_to_check":"Run 'wp plugin get wpforo --field=version' or see Plugins in WP admin; versions <= 3.2.1 are affected. Exploitable only if a searchable topic form field of type checkbox, or a select/autocomplete field with isMultiChoice enabled, is registered in the forum configuration.","fix":"Update wpForo Forum to 3.2.2 or later (Wordfence, Patchstack); a separate unauthenticated SQLi CVE-2026-119155 affects <= 3.2.2, so take the latest release.","status":"open","published_at":"2026-11-07T10:17:12+00:00","first_seen_at":"2026-11-07T10:46:41+00:00","triaged_at":"2026-11-07T10:48:24+00:00","updated_at":"2026-11-07T10:49:42+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-11-07T10:48:24Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"wpForo Forum WordPress plugin: unauthenticated SQL injection leaks database contents","impact":"high","summary":"The wpForo Forum plugin for WordPress passes the 'data' parameter into SQL queries without proper escaping or preparation, up to and including version 3.2.1. An unauthenticated attacker can append SQL to existing queries and extract sensitive data from the site's database.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","wpforo","self-hosted"],"confidence":0.8,"fix_status":"unknown","needs_auth":"no","worst_case":"database contents readable by unauthenticated remote attackers","analyst_note":"Sources list only NVD; check the wpForo plugin changelog or the WordPress plugin page for a fixed version beyond 3.2.1.","how_to_check":"- Check the installed wpForo version in the WordPress admin plugins list, or run `wp plugin get wpforo --field=version` with WP-CLI.\n- Look for a searchable topic form field of type checkbox, or a select/autocomplete field with isMultiChoice enabled, in the wpForo forum field configuration.","plain_action":"","needs_analyst":true,"not_affected_if":["plugin-not-installed","plugin-above-3.2.1","no-searchable-checkbox-or-multichoice-field"],"who_is_affected":"Sites running the wpForo Forum plugin at version 3.2.1 or earlier are exposed. The exploit path requires a searchable topic form field of type checkbox, or a select/autocomplete field with isMultiChoice enabled, to be registered in the forum configuration, so sites without such a field are likely not reachable through this path. Teams that do not run wpForo can skip it.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"high"},"cost_usd":0.00076,"input_tokens":4328,"output_tokens":654,"severity_before":"high"},"analyst_status":"done","analyst_note":"Sources list only NVD; check the wpForo plugin changelog or the WordPress plugin page for a fixed version beyond 3.2.1.","search":"'-2026':12A,15A '-95870':13A,16A '3.2.1':47B,89C 'addit':118C 'alreadi':122C 'append':52B,117C 'attack':50B,115C 'checkbox':146C 'configur':159C 'content':10A 'cve':11A,14A 'data':32B,60B,80C 'databas':9A,65B,135C 'due':90C 'enabl':153C 'escap':39B,93C 'exist':55B,106C,123C 'exploit':136C 'extract':58B,130C 'field':143C,150C 'form':142C 'forum':2A,26B,68C,158C 'generic':75C 'host':21B 'includ':45B,88C 'inform':132C 'inject':7A,77C 'insuffici':92C 'ismultichoic':152C 'lack':100C 'leak':8A 'make':110C 'packag':18B 'paramet':33B,81C,98C 'pass':30B 'plugin':4A,27B,69C 'possibl':112C 'prepar':41B,103C 'proper':38B 'queri':36B,56B,108C,120C,124C 'regist':155C 'requir':137C 'searchabl':140C 'select/autocomplete':149C 'self':20B 'self-host':19B 'sensit':59B,131C 'site':63B 'sql':6A,35B,53B,76C,107C,119C 'suffici':102C 'suppli':97C 'topic':141C 'type':145C 'unauthent':5A,49B,114C 'use':128C 'user':96C 'version':46B,84C 'via':78C 'vulner':73C 'without':37B 'wordpress':3A,22B,29B,71C 'wpforo':1A,17A,23B,25B,67C","nicknames":[],"mitigations":[],"who_affected":"WordPress sites running the wpForo Forum plugin version 3.2.1 or older. An unauthenticated visitor can send a crafted 'data' parameter and read database contents, but only when the forum has a searchable topic form field of type checkbox, or a select/autocomplete field with isMultiChoice enabled. Sites without wpForo, or without such a field, are not exposed through this path.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":["wpforo"],"ptokens":["wpforo"],"labels":["high","package","selfhosted","wordpress","wpforo"],"campaign_type":null,"search_a":"'-2026':12A,15A '-95870':13A,16A 'content':10A 'cve':11A,14A 'databas':9A 'forum':2A 'inject':7A 'leak':8A 'plugin':4A 'sql':6A 'unauthent':5A 'wordpress':3A 'wpforo':1A,17A","search_b":"'3.2.1':47B 'append':52B 'attack':50B 'data':32B,60B 'databas':65B 'escap':39B 'exist':55B 'extract':58B 'forum':26B 'host':21B 'includ':45B 'packag':18B 'paramet':33B 'pass':30B 'plugin':27B 'prepar':41B 'proper':38B 'queri':36B,56B 'self':20B 'self-host':19B 'sensit':59B 'site':63B 'sql':35B,53B 'unauthent':49B 'version':46B 'without':37B 'wordpress':22B,29B 'wpforo':23B,25B","search_c":"'3.2.1':89C 'addit':118C 'alreadi':122C 'append':117C 'attack':115C 'checkbox':146C 'configur':159C 'data':80C 'databas':135C 'due':90C 'enabl':153C 'escap':93C 'exist':106C,123C 'exploit':136C 'extract':130C 'field':143C,150C 'form':142C 'forum':68C,158C 'generic':75C 'includ':88C 'inform':132C 'inject':77C 'insuffici':92C 'ismultichoic':152C 'lack':100C 'make':110C 'paramet':81C,98C 'plugin':69C 'possibl':112C 'prepar':103C 'queri':108C,120C,124C 'regist':155C 'requir':137C 'searchabl':140C 'select/autocomplete':149C 'sensit':131C 'sql':76C,107C,119C 'suffici':102C 'suppli':97C 'topic':141C 'type':145C 'unauthent':114C 'use':128C 'user':96C 'version':84C 'via':78C 'vulner':73C 'wordpress':71C 'wpforo':67C","first_public_at":"2026-11-07T10:17:12+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","cvss_by":"security@wordfence.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-95870","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-95870","severity":null,"published_at":"2026-11-07T10:17:12+00:00","modified_at":"2026-11-07T10:17:12+00:00","first_seen_at":"2026-11-07T10:46:41+00:00","fetched_at":"2026-11-07T10:46:41+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-95870:2098","url":"https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/wpforo/wpforo-forum-321-unauthenticated-sql-injection-via-data-parameter","severity":null,"published_at":"2026-11-07T10:49:42+00:00","modified_at":"2026-11-07T10:49:42+00:00","first_seen_at":"2026-11-07T10:49:42+00:00","fetched_at":"2026-11-07T10:49:42+00:00","note":"Wordfence (CNA/researcher advisory) and Patchstack both say fixed in 3.2.2; affected <= 3.2.1. Not plugin-maintainer's own page (changelog not read), so nothing marked verified. No exploitation or PoC found. Newer wpForo <=3.2.2 has a separate unauth SQLi (CVE-2026-119155), so move to the latest release.","cites":["https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/wpforo/wpforo-forum-321-unauthenticated-sql-injection-via-data-parameter","https://patchstack.com/database/wordpress/plugin/wpforo/vulnerability/wordpress-wpforo-forum-plugin-3-2-1-unauthenticated-sql-injection-vulnerability","https://wordpress.org/plugins/wpforo/"]}],"documents":[{"id":94903,"url":"https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/wpforo/wpforo-forum-321-unauthenticated-sql-injection-via-data-parameter","title":"Wordfence: wpForo Forum <= 3.2.1 Unauthenticated SQL Injection via 'data'","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":94904,"url":"https://patchstack.com/database/wordpress/plugin/wpforo/vulnerability/wordpress-wpforo-forum-plugin-3-2-1-unauthenticated-sql-injection-vulnerability","title":"Patchstack: wpForo <= 3.2.1 SQL Injection","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":94906,"url":"https://wordpress.org/plugins/wpforo/","title":"wpForo Forum plugin page (WordPress.org)","kind":"vendor","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"mentions","confidence":null,"note":null}],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}