CVE-2026-28555
Received Received - Intake

Missing Authorization in wpForo 2.4.14 Allows Topic Manipulation

Publication date: 2026-02-28

Last updated on: 2026-03-04

Assigner: VulnCheck

Description
wpForo Forum 2.4.14 contains a missing authorization vulnerability that allows authenticated subscribers to close or reopen any forum topic via the wpforo_close_ajax handler. Attackers submit a valid nonce with an arbitrary topic ID to bypass the moderator permission requirement and disrupt forum discussions.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-02-28
Last Modified
2026-03-04
Generated
2026-07-06
AI Q&A
2026-03-01
EPSS Evaluated
2026-07-05
NVD
CVE-2026-28555
EUVD
EUVD-2026-9104

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
gvectors wpforo_forum From 2.4.0 (inc) to 2.4.16 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-862 The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Detection Guidance

I don't know

Mitigation Strategies

I don't know

Executive Summary

The vulnerability in wpForo Forum version 2.4.14 is a missing authorization flaw. It allows authenticated subscribers to close or reopen any forum topic by using the wpforo_close_ajax handler. Attackers can submit a valid nonce along with an arbitrary topic ID to bypass the moderator permission checks, enabling them to disrupt forum discussions.

Impact Analysis

This vulnerability can impact you by allowing unauthorized users with subscriber-level access to manipulate forum topics. They can close or reopen any topic without proper permissions, which can disrupt normal forum discussions and potentially degrade the user experience or the integrity of the forum content.

Compliance Impact

I don't know

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-28555. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart