CVE-2026-28562: wpForo Forum 2.4.14 SQL Injection via Topics ORDER BY Parameter
Published Feb 28, 2026
·Updated
wpForo 2.4.14 contains an unauthenticated SQL injection vulnerability in Topics::gettopics() where the ORDER BY clause relies on ineffective escsql() sanitization on unquoted identifiers. Attackers exploit the wpfob parameter with CASE WHEN payloads to perform blind boolean extraction of credentials from the WordPress database.
Affected Software
2 affected components
wpforo/wpforo
gVectors Wpforo Forum Wordpress>=2.4.0<2.4.15
Event History
Feb 28, 2026
CVE Published
via MITRE·09:47 PM
Data Sourced
via MITRE·09:47 PM
DescriptionSeverityWeakness
Data Sourced
via NVD·10:16 PM
DescriptionSeverityWeaknessAffected Software
Oct 9, 58329
Event
via NVD·01:07 AM
Frequently Asked Questions
1
What is the severity of CVE-2026-28562?
CVE-2026-28562 is considered a high severity SQL injection vulnerability.
2
How do I fix CVE-2026-28562?
To fix CVE-2026-28562, update wpForo to the latest version where the vulnerability has been patched.
3
What type of vulnerability is CVE-2026-28562?
CVE-2026-28562 is an SQL injection vulnerability affecting the Topics ORDER BY parameter.
4
Who is affected by CVE-2026-28562?
CVE-2026-28562 affects users of wpForo version 2.4.14.
5
Can CVE-2026-28562 be exploited remotely?
Yes, CVE-2026-28562 can be exploited remotely as it is an unauthenticated SQL injection.