CVE-2025-4203: wpForo Forum <= 2.4.8 - Unauthenticated SQL Injection via get_members Function
The wpForo Forum plugin for WordPress is vulnerable to error‐based or time-based SQL Injection via the getmembers() function in all versions up to, and including, 2.4.8 due to missing integer validation on the 'offset' and 'rowcount' parameters. The function blindly interpolates 'rowcount' into a 'LIMIT offset,rowcount' clause using escsql() rather than enforcing numeric values. MySQL 5.x’s grammar allows a 'PROCEDURE ANALYSE' clause immediately after a LIMIT clause. Unauthenticated attackers controlling 'rowcount' can append a stored‐procedure call, enabling error‐based or time‐based blind SQL injection that can be used to extract sensitive information from the database.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-4203?
CVE-2025-4203 is rated as a high severity vulnerability due to its potential for SQL injection attacks.
How do I fix CVE-2025-4203?
To fix CVE-2025-4203, you should update the wpForo Forum plugin to version 2.4.9 or later.
What are the consequences of exploiting CVE-2025-4203?
Exploiting CVE-2025-4203 could allow an attacker to execute arbitrary SQL commands, potentially compromising the database.
Which versions of wpForo Forum are affected by CVE-2025-4203?
CVE-2025-4203 affects all versions of the wpForo Forum plugin up to and including version 2.4.8.
What functionality is compromised by CVE-2025-4203?
CVE-2025-4203 compromises the get_members() function within the wpForo Forum plugin due to missing integer validation.