Description

The wpForo Forum plugin for WordPress is vulnerable to SQL Injection via the 'referer' parameter in all versions up to, and including, 2.4.17. This is due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.5",
  "pubDate": "2026-08-28T08:16:41.003Z",
  "pubdate": "2026-08-28T08:16:41.003Z",
  "executiveSummary": "The wpForo Forum plugin for WordPress contains a critical SQL injection vulnerability in versions up to and including 2.4.17.\nThe vulnerability originates from the application's failure to properly sanitize or parameterize the 'referer' parameter before incorporating it into backend SQL queries.\nThis security flaw allows unauthenticated remote attackers to execute arbitrary SQL commands against the underlying database.\nSuccessful exploitation grants an attacker the ability to bypass authentication, access sensitive data, or modify database records, posing a severe risk to the confidentiality and integrity of the WordPress site.\nNo specific authentication or administrative privileges are required for an attacker to initiate an exploit, as the vulnerability is accessible via unauthenticated HTTP requests.\nThe impact is significant, potentially leading to full site compromise depending on the database user permissions.",
  "technicalDetails": "The vulnerability is identified as a classic SQL Injection (SQLi) flaw occurring within the request handling logic of the wpForo Forum plugin.\nThe root cause is the improper handling of the user-supplied 'referer' parameter. The plugin fails to apply adequate escaping mechanisms or use prepared statements when constructing dynamic SQL queries that incorporate this input.\nThe lack of prepared statements or parameterized queries allows an attacker to break out of the intended query context by injecting malicious SQL syntax.\nAn unauthenticated attacker can manipulate the 'referer' HTTP header or parameter to append secondary SQL commands, effectively performing a stacked query injection or boolean-based blind injection.\nThe attack flow proceeds as follows: 1) The attacker crafts an HTTP request containing a malicious payload within the 'referer' parameter. 2) The plugin receives this request and processes the unsanitized input directly into an internal database query. 3) The database engine executes the concatenated query, allowing the attacker's injected code to run with the privileges of the web application's database user. 4) The results of the injected queries can be extracted by observing responses or time-based anomalies.\nBecause the 'referer' parameter is processed without verification, the plugin is susceptible to automated scanning and exploitation tools.\nThis vulnerability affects versions up to and including 2.4.17. The exposure is network-based, meaning any visitor capable of reaching the web server can trigger the vulnerability.\nPost-exploitation consequences are severe. Because the attacker can interact directly with the database, they may extract sensitive user credentials, forum configurations, or private message data. In instances where the database user has elevated privileges (such as FILE permissions), an attacker might achieve remote code execution (RCE) via techniques like INTO OUTFILE, leading to full server compromise."
}