CVE-2025-4203 wpForo Forum <= 2.4.8 - Unauthenticated SQL Injection via get_members Function
Unauthenticated attackers can exploit SQL injection in wpForo Forum to extract sensitive database information via the get_members function.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2025-4203?
CVE-2025-4203 is a high-severity SQL injection vulnerability in tomdever wpForo Forum, published on 25 Oct 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The wpForo Forum plugin for WordPress is vulnerable to error‐based or time-based SQL Injection via the get_members() function in all versions up to, and including, 2.4.8 due to missing integer validation on the 'offset' and 'row_count' parameters. The function blindly interpolates 'row_count' into a 'LIMIT offset,row_count' clause using esc_sql() rather than enforcing numeric values. MySQL 5.x’s grammar allows a 'PROCEDURE ANALYSE' clause immediately after a LIMIT clause. Unauthenticated attackers controlling 'row_count' can append a stored‐procedure call, enabling error‐based or time‐based blind SQL injection that can be used to extract sensitive information from the database.
Weakness: CWE-89
Which versions are affected by CVE-2025-4203?
How do I fix CVE-2025-4203?
No fix has been published for CVE-2025-4203 yet. Limit exposure of the affected software until one is available.
Use parameterised queries everywhere and never build SQL by joining strings. Upgrade affected software first; a web application firewall only buys time. More about SQL injection.
Is CVE-2025-4203 being exploited?
There is no known exploitation of CVE-2025-4203 in the wild and no public exploit code.
Sources
Also known as GHSA-xwxm-298x-phpj.