CVE-2026-28556

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2026-28556
wpForo Forum 2.4.14 contains a missing authorization vulnerability that allows authenticated subscribers to move, merge, or split any forum topic via the topic_move, topic_merge, and topic_split form action handlers. Attackers with a valid form nonce can reorganize arbitrary forum content without moderator permissions, including relocating topics to private forums.

5.4 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 2.8 / Impact : 2.5

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact NONE

Scope UNCHANGED

References
Link Resource
https://wordpress.org/plugins/wpforo/ Product
https://wordpress.org/plugins/wpforo/#developers Release Notes
https://www.vulncheck.com/advisories/wpforo-forum-missing-authorization-via-topic-management-form-handlers Third Party Advisory
Configurations

Configuration 1 (hide)

cpe:2.3:a:gvectors:wpforo_forum:*:*:*:*:*:wordpress:*:*
History

04 Mar 2026, 02:52

Type Values Removed Values Added
CPE cpe:2.3:a:gvectors:wpforo_forum:*:*:*:*:*:wordpress:*:*
References () https://wordpress.org/plugins/wpforo/ - () https://wordpress.org/plugins/wpforo/ - Product
References () https://wordpress.org/plugins/wpforo/#developers - () https://wordpress.org/plugins/wpforo/#developers - Release Notes
References () https://www.vulncheck.com/advisories/wpforo-forum-missing-authorization-via-topic-management-form-handlers - () https://www.vulncheck.com/advisories/wpforo-forum-missing-authorization-via-topic-management-form-handlers - Third Party Advisory
First Time Gvectors
Gvectors wpforo Forum

02 Mar 2026, 20:30

Type Values Removed Values Added
Summary
  • (es) wpForo Forum 2.4.14 contiene una vulnerabilidad por falta de autorización que permite a suscriptores autenticados mover, fusionar o dividir cualquier tema del foro a través de los manejadores de acción de formulario topic_move, topic_merge y topic_split. Atacantes con un nonce de formulario válido pueden reorganizar contenido arbitrario del foro sin permisos de moderador, incluyendo reubicar temas a foros privados.

28 Feb 2026, 22:16

Type Values Removed Values Added
New CVE
Information

Published : 2026-02-28 22:16

Updated : 2026-03-04 02:52

NVD link : CVE-2026-28556

Mitre link : CVE-2026-28556

CVE.ORG link : CVE-2026-28556

JSON object : View

Products Affected

gvectors

  • wpforo_forum
CWE
CWE-862

Missing Authorization