CVE-2026-28559

MEDIUM

5.3

Beschreibung

wpForo Forum 2.4.14 contains an information disclosure vulnerability that allows unauthenticated users to retrieve private and unapproved forum topics via the global RSS feed endpoint. Attackers request the RSS feed without a forum ID parameter, bypassing the privacy and status WHERE clauses that are only applied when a specific forum ID is present in the query.

CVE Details

CVSS v3.1 Bewertung5.3

SchweregradMEDIUM

CVSS VektorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

AngriffsvektorNETWORK

KomplexitatLOW

Erforderliche PrivilegienNONE

BenutzerinteraktionNONE

Veroffentlicht2/28/2026

Zuletzt geandert3/4/2026

Quellenvd

Honeypot-Sichtungen0

Betroffene Produkte

gvectors:wpforo_forum

Schwachen (CWE)

CWE-200

Referenzen

https://wordpress.org/plugins/wpforo/(disclosure@vulncheck.com)

https://wordpress.org/plugins/wpforo/#developers(disclosure@vulncheck.com)

https://www.vulncheck.com/advisories/wpforo-forum-information-disclosure-via-global-rss-feed(disclosure@vulncheck.com)

IOC Korrelationen

Keine Korrelationen erfasst

This product uses data from the NVD API but is not endorsed or certified by the NVD.