CVE-2026-40798: WordPress wpForo Forum plugin <= 3.0.4 - SQL Injection vulnerability

Synopsis

An unauthenticated SQL injection vulnerability affects the wpForo Forum WordPress plugin at version 3.0.4 and below. The flaw is reachable over the network with no credentials required and no user interaction needed, making it trivially accessible to any attacker who can reach the WordPress site. Successful exploitation allows an attacker to read sensitive data from the underlying database and cause limited disruption to the service. No fix version has been published yet; HarborGuard tracks the advisory and will make a patched-image rebuild available as soon as upstream ships a fix.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The vulnerable endpoint is exposed over the network, so an attacker must be able to send HTTP requests to the target WordPress site.

• AuthenticationNot required

  No account or session token is needed; the injection point is accessible to anonymous requests.

• Victim interactionNot required

  The attacker does not need any user on the target site to take any action; exploitation is fully self-contained.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and requires no special timing, race conditions, or environment-specific setup.

Blast Radius

• Reads arbitrary rows from the WordPress database, including hashed passwords, user email addresses, private posts, and any data stored by other installed plugins.
• Extracts session tokens or authentication credentials stored in the database, enabling follow-on account takeover against site administrators or registered users.
• Causes limited disruption to the forum service through malformed queries, potentially degrading availability for site visitors.
• Scope is marked Changed in the CVSS vector, meaning a successful attack can affect resources beyond the vulnerable component itself, such as other applications sharing the same database server.