CVE-2026-28562 is a high severity SQL injection in the wpForo Forum WordPress plugin, version 2.4.14. The topic sorting code relies on escaping that does not protect an unquoted identifier, and it needs no login. Update the plugin to the newest release and confirm the fix in its changelog.
What's affected
The record names wpForo 2.4.14. VulnCheck's advisory lists the affected range as 2.4 up to 2.4.15 in its summary, so treat 2.4.14 and nearby versions as affected.
The flaw is in the get_topics() function of the Topics class, in how the ORDER BY clause is built from a request parameter.
How to check if you're exposed
In the WordPress admin, open Plugins and read the wpForo Forum version. Or use WP-CLI:
wp plugin list --name=wpforo --fields=name,version,update
If an update is shown, apply it. The plugin's Developers tab on WordPress.org holds the changelog.
What to do now
- Update wpForo Forum to the latest version available from WordPress.org.
- Read the changelog entry to confirm the update covers this issue, as the record does not name a fixed version.
- If you cannot update now, deactivate the plugin or put the forum behind a web application firewall rule for the sorting parameter.
- Review database and access logs for unusual query activity, and rotate administrator passwords if you suspect extraction.
Why it matters
This is CWE-89, SQL injection. The code calls an escaping function on a value placed in an ORDER BY clause where there are no quotes. Escaping works by guarding quote characters, so on an unquoted identifier it protects nothing.
The advisory text says the flaw lets an unauthenticated attacker pull data such as credentials from the WordPress database through blind techniques. On a forum plugin that stores user data, that is a real privacy risk. The record does not mark the CVE as exploited in the wild.
The fix for sort fields is an allowlist of column names, not escaping.
Quick check
Why is escaping not enough for ORDER BY?
Escaping handles quote characters in string values. A column name in ORDER BY is not a quoted string, so input can change the query structure. Allowlisting the permitted column names is the safe approach.
Sources
Last reviewed: 19 October 2026.
