wpForo Forum <= 3.1.7 - Unauthenticated SQL Injection via Custom Field Search Values
- ID
- WPSEC-2026-0298
- Plugin
- wpForo Forum (wpforo)
- Affected
- from 2.1.7 before 3.2.0
- Remediation
- Update to 3.2.0 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
- Weakness
- CWE-89
- Usage
- Plugin Medium · Affected versions Low among sites WPSec scans, 2026-10-22
- Attack surface
- wpForo Forum on WPSec AttackSurface
- Fix released
- Published
Description
The wpForo Forum plugin for WordPress is vulnerable to SQL Injection via custom field values in the forum search ('data' parameter) in versions 2.1.7 up to, and including, 3.1.7 due to insufficient escaping of the user supplied value, which was only passed through preg_quote() before being placed inside a quoted REGEXP string literal in the SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. The vulnerable code is only reached when a checkbox, multi-choice select or multi-choice autocomplete topic field exists, which requires the wpForo Topic Custom Fields addon.
References
- https://wpsec.com/vuln/WPSEC-2026-0298/
- https://plugins.svn.wordpress.org/wpforo/tags/3.2.0/
- https://wordpress.org/plugins/wpforo/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS