Beveiligingsadvies

CVE-2026-28557

CVE-kwetsbaarheidsdetails - eXtreme Datacenter Security Operations

Gepubliceerd 2026-02-28 21:47:37

Laatst bijgewerkt 2026-05-25 23:41:55

Toegewezen door VulnCheck

CVSS-score 7.1

Status PUBLISHED

Beschrijving

wpForo Forum 2.4.14 contains a missing capability check vulnerability that allows authenticated users to trigger bulk wpForo usergroup reassignment via the wpforo_synch_roles AJAX handler. Attackers access the usergroups admin page, accessible to any authenticated user, to obtain a nonce, then remap all wpForo usergroups to arbitrary WordPress roles.

← Alle CVE's bekijken Bekijk op cve.org ↗