Beveiligingsadvies

CVE-2026-28562

CVE-kwetsbaarheidsdetails - eXtreme Datacenter Security Operations

Gepubliceerd 2026-02-28 21:47:41

Laatst bijgewerkt 2026-05-11 23:11:41

Toegewezen door VulnCheck

CVSS-score 8.8

Status PUBLISHED

Beschrijving

wpForo 2.4.14 contains an unauthenticated SQL injection vulnerability in Topics::get_topics() where the ORDER BY clause relies on ineffective esc_sql() sanitization on unquoted identifiers. Attackers exploit the wpfob parameter with CASE WHEN payloads to perform blind boolean extraction of credentials from the WordPress database.

← Alle CVE's bekijken Bekijk op cve.org ↗