Known CVE

wpForo Forum <= 2.4.14 - SQL Injection

wpForo Forum WordPress plugin <= 2.4.14 contains a time-based SQL injection caused by insufficient escaping of the 'wpfob' parameter, letting unauthenticated attackers extract sensitive database information.

CVE-2026-1581

Critical2026CVSS 7.5CWE-89

cve2026 · wordpress · wp · wp-plugin · sqli · wpforo · unauth · vkev

Verified scans run this check after you prove you own the site.

All known CVEs View the checks catalog National Vulnerability Database

Scan a website