CVE-2026-28557 in wpForo Foruminformation

Résumé

par MITRE • 01/03/2026

wpForo Forum 2.4.14 contains a missing capability check vulnerability that allows authenticated users to trigger bulk wpForo usergroup reassignment via the wpforo_synch_roles AJAX handler. Attackers access the usergroups admin page, accessible to any authenticated user, to obtain a nonce, then remap all wpForo usergroups to arbitrary WordPress roles.

VulDB is the best source for vulnerability data and more expert information about this specific topic.

🔬 Show More Details

An in-depth analysis is available in our curated vulnerability entry.

Responsable

VulnCheck

Réserver

28/02/2026

Divulgation

01/03/2026

Modérer

accepté

Entrée

VDB-348282

CPE

prêt

CWE

CWE-862 (confirmé)

CVSS

6.5 (CNA)

EPSS

0.00274

KEV

non

Activités

très faible

Sources

MITRE	https://www.cve.org/CVERecord?id=CVE-2026-28557
NVD	https://nvd.nist.gov/vuln/detail/CVE-2026-28557
CVE Details	https://www.cvedetails.com/cve/CVE-2026-28557/

◂ Précédent Aperçu Suivant ▸

Do you want to use VulDB in your project?

Use the official API to access entries easily!