---
id: "CVE-2026-95870"
page: "https://infrastack.ai/live/CVE-2026-95870"
kind: "vulnerability"
aliases: ["CVE-2026-95870"]
title: "wpForo Forum WordPress plugin: unauthenticated SQL injection leaks database contents"
severity: "high"
cvss: 7.5
epss: null
exploited: false
status: "open"
category: "package"
products: [{"name": "wpforo", "fixed": ["3.2.2"], "affected": "<= 3.2.1", "ecosystem": "wordpress"}]
ecosystems: []
tags: ["package", "self-hosted", "wordpress", "wpforo"]
not_affected_if: ["no-multichoice-search-field", "no-searchable-checkbox-or-multichoice-field", "plugin-above-3.2.1", "plugin-not-installed", "wpforo-3.2.2-or-later"]
published_at: "2026-11-07T10:17:12+00:00"
first_seen_at: "2026-11-07T10:46:41+00:00"
updated_at: "2026-11-07T10:49:42+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-95870", "first_seen_at": "2026-11-07T10:46:41+00:00"}, {"source": "analyst", "url": "https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/wpforo/wpforo-forum-321-unauthenticated-sql-injection-via-data-parameter", "first_seen_at": "2026-11-07T10:49:42+00:00", "cites": ["https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/wpforo/wpforo-forum-321-unauthenticated-sql-injection-via-data-parameter", "https://patchstack.com/database/wordpress/plugin/wpforo/vulnerability/wordpress-wpforo-forum-plugin-3-2-1-unauthenticated-sql-injection-vulnerability", "https://wordpress.org/plugins/wpforo/"]}]
exploit_sources: []
---

# wpForo Forum WordPress plugin: unauthenticated SQL injection leaks database contents

Link for people: https://infrastack.ai/live/CVE-2026-95870 (this .md is for agents)

The wpForo Forum plugin for WordPress passes the 'data' parameter into SQL queries without proper escaping or preparation, up to and including version 3.2.1. An unauthenticated attacker can append SQL to existing queries and extract sensitive data from the site's database.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- wordpress:wpforo affected <= 3.2.1 fixed 3.2.2

## How to check

Run 'wp plugin get wpforo --field=version' or see Plugins in WP admin; versions <= 3.2.1 are affected. Exploitable only if a searchable topic form field of type checkbox, or a select/autocomplete field with isMultiChoice enabled, is registered in the forum configuration.

## Fix

Update wpForo Forum to 3.2.2 or later (Wordfence, Patchstack); a separate unauthenticated SQLi CVE-2026-119155 affects <= 3.2.2, so take the latest release.

## Timeline

- 2026-11-07T10:46:41+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-95870
- 2026-11-07T10:49:42+00:00 analyst https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/wpforo/wpforo-forum-321-unauthenticated-sql-injection-via-data-parameter — Wordfence (CNA/researcher advisory) and Patchstack both say fixed in 3.2.2; affected <= 3.2.1. Not plugin-maintainer's own page (changelog not read), so nothing marked verified. No exploitation or PoC found. Newer wpForo <=3.2.2 has a separate unauth SQLi (CVE-2026-119155), so move to the latest release.

## Documents

- [advisory] Wordfence: wpForo Forum <= 3.2.1 Unauthenticated SQL Injection via 'data' https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/wpforo/wpforo-forum-321-unauthenticated-sql-injection-via-data-parameter
- [advisory] Patchstack: wpForo <= 3.2.1 SQL Injection https://patchstack.com/database/wordpress/plugin/wpforo/vulnerability/wordpress-wpforo-forum-plugin-3-2-1-unauthenticated-sql-injection-vulnerability
- [mentions] wpForo Forum plugin page (WordPress.org) https://wordpress.org/plugins/wpforo/

## From the sources

The wpForo Forum plugin for WordPress is vulnerable to generic SQL Injection via the 'data' parameter in all versions up to, and including, 3.2.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. Exploitation requires that a searchable topic form field of type checkbox, or a select/autocomplete field with isMultiChoice enabled, is registered in the forum configuration.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_