CVE-2026-28559 wpForo Forum 2.4.14 Information Disclosure via Global RSS Feed
Unauthenticated attackers can access private and unapproved forum topics by requesting the global RSS feed without a forum ID parameter.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-28559?
CVE-2026-28559 is a medium-severity vulnerability in gVectors Team wpForo Forum, published on 28 Feb 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
wpForo Forum 2.4.14 contains an information disclosure vulnerability that allows unauthenticated users to retrieve private and unapproved forum topics via the global RSS feed endpoint. Attackers request the RSS feed without a forum ID parameter, bypassing the privacy and status WHERE clauses that are only applied when a specific forum ID is present in the query.
Weakness: CWE-200
Which versions are affected by CVE-2026-28559?
It affects 1 product.
Products include Gvectors Wpforo Forum.
How do I fix CVE-2026-28559?
No fix has been published for CVE-2026-28559 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-28559 being exploited?
There is no known exploitation of CVE-2026-28559 in the wild and no public exploit code.
Other vulnerabilities in gVectors Team wpForo Forum
- CVE-2024-3200 wpForo Forum <= 2.3.3 - Authenticated (Contributor+) SQL Injection
- CVE-2022-40200 WordPress wpForo Forum plugin <= 2.0.9 - Auth. Arbitrary File Upload vulnerability
- CVE-2018-16613 Privilege escalation in n/a
- CVE-2026-28562 wpForo Forum 2.4.14 SQL Injection via Topics ORDER BY Parameter
- CVE-2023-2249 Server-side request forgery in wpForo Forum
Sources
Also known as GHSA-wwmc-gh3w-x32h.