Vulnerability Bulletins |
CVE-2026-28562 |
|
| Affected software | WORDPRESS |
| wpForo 2.4.14 contains an unauthenticated SQL injection vulnerability in Topics::get_topics() where the ORDER BY clause relies on ineffective esc_sql() sanitization on unquoted identifiers. Attackers exploit the wpfob parameter with CASE WHEN payloads to perform blind boolean extraction of credentials from the WordPress database. | |
Link: |
|
| https://nvd.nist.gov/vuln/detail/CVE-2026-28562 | |