CVE-2026-1581

wpForo Forum <= 2.4.14 - Unauthenticated Time-Based SQL Injection

No known exploitation. EPSS puts it in the 85th percentile. No fix published yet.

CVSS 3.17.5High EPSS percentile85th2.5% chance in 30 days CISA KEVNot listedNo confirmed exploitation
No public exploit known FixNone yetNo fix or workaround published

Published 2026-02-19Updated 2026-02-20Sources: CVE.org, NVD

NVD CVE.org

What to do

No fixed build or workaround is published yet. Limit exposure and watch for a patch.

tomdever wpForo ForumAffected: ≤ 2.4.14Upgrade to: after 2.4.14Stated by: CVE record

Versions as the sources state them. Full version matrix after sign-in

Steps

Written by AI from the record

Check whether your WordPress site uses wpForo Forum and whether its version is 2.4.14 or earlier.
No fixed version has been published in the available information; contact the plugin vendor for a supported fix or removal guidance.
Until a fix is available, disable the wpForo Forum plugin or restrict public access to the forum.
Ask IT to review WordPress, database, and administrator accounts for unexpected changes or access.

May need vendor or contractor work

Check it yourselfA free Nuclei check exists for this CVE. Run it against your hosts.Is your organisation exposed?Discuss checks for your systems with a specialist. Scope is agreed before testing.

What it is

From the CVE record

The wpForo Forum plugin for WordPress is vulnerable to time-based SQL Injection via the 'wpfob' parameter in all versions up to, and including, 2.4.14 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.

In plain language

Written by AI from the record

wpForo Forum 2.4.14 and earlier lets outsiders read sensitive database information, so small businesses using it should treat this as urgent.

Unauthenticated time-based SQL injection through the `wpfob` parameter allows remote extraction of confidential WordPress database contents from wpForo Forum versions through 2.4.14.

If you're affected

Customer data exposure
User account data exposure
Forum content exposure
Privacy breach
Cleanup and downtime

What is it

This is a flaw in a forum add-on for WordPress that can let a stranger quietly pull confidential information from the site’s database. Think of it as someone being able to ask a receptionist carefully worded questions until they reveal pages from a locked filing cabinet.

Who is affected

This matters to you if your WordPress site uses wpForo Forum, especially version 2.4.14 or earlier. It is a risk when the forum can be reached over the internet; the attacker does not need an account or anyone to click anything.

How urgent is it

Attackers are already exploiting this vulnerability in an active compromise campaign, including deploying persistent backdoors on affected sites. Treat this as a red-level incident: check exposure now and remove public access to the vulnerable forum if a supported fix is not available.

What to do — in detail

Confirm whether wpForo Forum is installed, enabled, publicly reachable, and at version 2.4.14 or earlier.
There is no published fixed version in the available patch information. Do not assume an update resolves CVE-2026-1581 until the vendor explicitly identifies a fixed release.
If the plugin is enabled on an internet-facing site, disable it or block public routes to the forum while obtaining vendor-supported remediation. Preserve a backup before making changes.
Review web-server and WordPress logs for suspicious requests containing the wpfob parameter, and investigate unexpected administrator users, modified plugin/theme files, database changes, scheduled tasks, and unfamiliar code that restores itself after removal.
Because reported compromises used persistent backdoors, a site with signs of compromise should be rebuilt or cleaned through an incident-response process rather than relying only on deleting one suspicious file.
CISA has not listed this CVE in KEV, so no CISA remediation due date applies.

Technical context

CVE-2026-1581 is CVSS 7.5 High (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) and maps to CWE-89. The issue is unauthenticated, network-reachable time-based SQL injection in the wpfob parameter affecting wpForo Forum through 2.4.14; crafted requests can delay database responses and support extraction of confidential database data. News reporting confirms active exploitation and reports compromises involving a persistent WordPress backdoor with file, database, and shared-memory persistence. It is not listed in CISA KEV. Public exploit material is limited to a detection template; no public patch information is available.

This is a general assessment based on public vulnerability data. It does not account for your specific infrastructure — when in doubt, consult a security specialist.

Exploitation

Where each signal puts this CVE on the scale from published to confirmed exploited.

EPSS85th

CISA KEV

Not in the catalog. CISA has not confirmed exploitation.

Public exploits

No public exploit or proof of concept found in the sources we track.

EPSS

2.5% chance of exploitation activity in the next 30 days, which ranks it in the 85th percentile of scored CVEs.

Exploit Prediction Scoring System, FIRST.org. A probability, not a confirmation.

Lifecycle

7 events over 67 days, from the signal feeds we watch.

2026-04-27EPSS band changemoderate → low
2026-03-23EPSS band changelow → moderate
2026-03-06Nuclei check added
2026-02-20Record updated
2026-02-19Publishedweakness classified, att&ck mapped

Affected products

tomdeveross-projectaka tom dever
- wpForo ForumOn-premWeb & CMS Plugins / forum-wiki

Technical detail

CVSS 3.1 vector

Open in the CVSS calculator

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Scored 7.5 by NVD.

How it is reached

Attack Vector NetworkExploitable remotely over the network without any special conditions
Attack Complexity LowNo special conditions — the attack can be reliably reproduced
Privileges Required NoneNo authentication required — anyone can exploit this
User Interaction NoneNo user interaction needed — fully automated exploitation

Scope

Scope UnchangedImpact is limited to the vulnerable component itself

Impact if exploited

Confidentiality HighTotal information disclosure — all data in the component is compromised
Integrity NoneNo integrity impact
Availability NoneNo availability impact