The wpForo Forum plugin for WordPress contains a critical SQL injection vulnerability that allows unauthenticated attackers to exfiltrate sensitive data from the underlying database.

The plugin fails to properly sanitize the wpfob parameter, resulting in a time-based SQL injection vulnerability (CWE-89). This flaw allows unauthenticated attackers to manipulate SQL queries to bypass security controls and access sensitive information stored in the database.

Successful exploitation of this vulnerability could lead to the unauthorized disclosure of sensitive business information, including user credentials, personal data, or proprietary forum content. Given the CVSS score of 7.5 and the unauthenticated nature of the attack, the risk to data confidentiality is significant. Such a breach could result in severe reputational damage and potential regulatory non-compliance.

Immediate Action: Update the wpForo Forum plugin to version 2.4.15 or the latest available release immediately to apply the vendor-provided patch.

Proactive Monitoring: Monitor database query logs for unusual, high-latency queries or patterns indicative of time-based blind SQL injection attempts originating from the web server.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to block common SQL injection patterns and restrict access to the vulnerable wpfob parameter until the update is applied.

Public Exploit Available: No (Nuclei detection template exists, but no weaponized exploit or published Proof-of-Concept identified).

This vulnerability represents a high-risk entry point due to its unauthenticated nature and potential for data exfiltration. Organizations utilizing the wpForo Forum plugin must prioritize the update to version 2.4.15 or higher. If immediate patching is not feasible, restrict access to the affected forum components or implement rigorous WAF filtering to mitigate the risk of exploitation.