CVE-2026-28562

HighPublic PoC

Published: 28 February 2026

Published

28 February 2026

Modified

05 March 2026

KEV Added

—

Patch

—

CVSS Score v4 8.8 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

EPSS Score 0.0043 34.2th percentile

Risk Priority 55 floored blend · peak EPSS

Summary

CVE-2026-28562 is a high-severity SQL Injection (CWE-89) vulnerability in Gvectors Wpforo Forum. Its CVSS base score is 8.8 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 34.2th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.

The strongest mitigations our analysis identified are NIST 800-53 RA-5 (Vulnerability Monitoring and Scanning) and SI-10 (Information Input Validation).

Deeper analysis

CVE-2026-28562 is an unauthenticated SQL injection vulnerability in wpForo 2.4.14, a WordPress forum plugin. The flaw exists in the Topics::get_topics() function, where the ORDER BY clause relies on ineffective esc_sql() sanitization for unquoted identifiers controlled by the wpfob parameter. This allows attackers to inject malicious SQL payloads, classified under CWE-89, with a CVSS v3.1 base score of 8.2 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N).

Unauthenticated attackers can exploit this vulnerability over the network with low complexity and no user interaction required. By supplying CASE WHEN payloads in the wpfob parameter, they can conduct blind boolean-based extraction of credentials and other sensitive data from the WordPress database, resulting in high confidentiality impact and low integrity impact, but no availability disruption.

Advisories, including the VulnCheck report at https://www.vulncheck.com/advisories/wpforo-sql-injection-via-topics-order-by-parameter, provide further details on the issue. The wpForo plugin pages at https://wordpress.org/plugins/wpforo/ and https://wordpress.org/plugins/wpforo/#developers offer additional resources for developers and users.

OWASP Top 10 for Web (2025)

EU & UK References

🇪🇺 ENISA EUVD: EUVD-2026-9111

Vulnerability details

wpForo 2.4.14 contains an unauthenticated SQL injection vulnerability in Topics::get_topics() where the ORDER BY clause relies on ineffective esc_sql() sanitization on unquoted identifiers. Attackers exploit the wpfob parameter with CASE WHEN payloads to perform blind boolean extraction of credentials from…

the WordPress database.

CWE(s): CWE-89

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access

Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.

attack.mitre.org →

T1213.006 Databases Collection

Adversaries may leverage databases to mine valuable information.

attack.mitre.org →

Why these techniques?

Unauthenticated SQLi in public-facing WP plugin directly enables T1190 exploitation for blind boolean-based DB data/credential extraction, mapping to T1213.006.

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0