wpForo Forum Through 3.2.2 - Actively Exploited Unauthenticated SQL Injection (CVE-2026-119155)

wpForo Forum through 3.2.2 has an actively exploited unauthenticated SQL injection affecting board URL handling. Update to 3.2.3 or later.

wpForo Forum versions through 3.2.2 are vulnerable to an unauthenticated SQL injection tracked as CVE-2026-119155. Patchstack lists the vulnerability as known to be exploited. Update to wpForo 3.2.3 or later; WordPress.org currently offers a newer release and administrators should prefer the latest patched version.

Table of Contents

Vulnerability summary

Plugin: wpForo Forum
Affected versions: 3.2.2 and earlier
Fixed version: 3.2.3
Current version checked: 3.2.4
CVE: CVE-2026-119155
Class: Unauthenticated time-based SQL injection
Severity: CVSS 9.3 (Patchstack) / 7.5 High (Wordfence)
Required privilege: None
User interaction: None
Exploitation status: Listed by Patchstack as known to be exploited; this is Patchstack telemetry, not a CISA Known Exploited Vulnerabilities catalog designation
Install base: 20,000+ active installations on WordPress.org

How the SQL injection works

Wordfence Intelligence attributes the issue to insufficient escaping and query preparation for the href[locale] input used in wpForo board URL handling. An unauthenticated attacker can influence an existing database query and use time-based responses to infer sensitive database content.

The affected action uses a nonce, but that nonce is exposed to unauthenticated visitors in the public wpforo.nonces JavaScript object on forum pages. Loading a public forum page is therefore sufficient to obtain the request token; an account is not required.

This advisory intentionally omits injection strings, request templates, and other material that would enable exploitation.

Potential impact

Time-based SQL injection can allow an attacker to extract information from the WordPress database one result at a time. Depending on database privileges and configuration, exposed data can include user records, password hashes, email addresses, plugin settings, API credentials, and private forum content.

WordPress password hashes are not plaintext passwords, but theft still creates material risk and should trigger credential and session review.

Immediate mitigation

Update wpForo Forum to version 3.2.3 or later immediately.
Prefer the latest available release rather than stopping at the first fixed version.
After updating, purge page cache, CDN cache, and object cache as recommended by the plugin vendor.
If the update cannot be completed immediately, deactivate wpForo or restrict public access to forum routes until the patched release is deployed.
Review WAF, web-server, database, and application logs for suspicious requests and repeated delayed responses involving wpForo endpoints.
If exploitation is suspected, rotate database credentials and WordPress salts, reset privileged credentials, and invalidate active sessions after preserving evidence.

Verify the installed version

From the WordPress root, use WP-CLI to confirm the plugin version and install the current release:

wp plugin get wpforo --fields=name,status,version
wp plugin update wpforo
wp plugin get wpforo --fields=name,status,version
wp cache flush

The final version must be 3.2.3 or newer. Also update any deployment lockfile, container image, or managed-plugin policy that could restore a vulnerable package.

Related fixes in wpForo 3.2.3

The official changelog says version 3.2.3 fixed SQL injection in board URL handling and also addressed privilege escalation in theme management and usergroup assignment, stored XSS in moderation tools, and permission checks for guest submissions. Wordfence separately records another unauthenticated SQL injection affecting wpForo through 3.2.1 as CVE-2026-95870. Updating to the latest release addresses the disclosed 3.2.x security set.

Indicators and investigation

No universal malicious IP address, domain, or file hash has been published for CVE-2026-119155. Look for behavioral indicators:

Repeated unauthenticated requests to wpForo actions with nested locale parameters
Requests followed by consistent, artificial response delays
Database slow-query or error-log entries tied to wpForo requests
Unrecognized administrator logins, password resets, or session creation
Unexpected changes to users, usergroups, plugins, themes, or scheduled tasks
Outbound connections or newly written PHP files following suspicious forum traffic

Useful defensive checks include:

wp user list --role=administrator --fields=ID,user_login,user_email,user_registered
wp plugin list --status=active --fields=name,status,version,update
wp cron event list --fields=hook,next_run_gmt,recurrence
wp core verify-checksums

Compare results with the approved account and deployment inventory. Preserve relevant access logs, PHP logs, database logs, and WAF events before rotating credentials or cleaning affected files.

Remediation checklist

Update wpForo to 3.2.3 or later, preferably the current release.
Purge page, CDN, and object caches after the update.
Review logs covering the disclosure and active-exploitation window.
Inspect privileged accounts, usergroups, plugins, themes, scheduled tasks, and recently modified PHP files.
Rotate database credentials, salts, and privileged passwords when compromise is suspected.
Verify forum pages, authentication, canonical URLs, and cache behavior after remediation.

wpForo Forum Through 3.2.2 – Actively Exploited Unauthenticated SQL Injection (CVE-2026-119155)