CVE-2026-28555
Received Received - Intake
Missing Authorization in wpForo 2.4.14 Allows Topic Manipulation

Publication date: 2026-02-28

Last updated on: 2026-03-04

Assigner: VulnCheck

Description
wpForo Forum 2.4.14 contains a missing authorization vulnerability that allows authenticated subscribers to close or reopen any forum topic via the wpforo_close_ajax handler. Attackers submit a valid nonce with an arbitrary topic ID to bypass the moderator permission requirement and disrupt forum discussions.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2026-02-28
Last Modified
2026-03-04
Generated
2026-06-16
AI Q&A
2026-03-01
EPSS Evaluated
2026-06-14
NVD
CVE-2026-28555
EUVD
EUVD-2026-9104
Affected Vendors & Products
Showing 1 associated CPE
Vendor Product Version / Range
gvectors wpforo_forum From 2.4.0 (inc) to 2.4.16 (exc)
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-862 The product does not perform an authorization check when an actor attempts to access a resource or perform an action.
Attack-Flow Graph
AI Quick Actions
Instant insights powered by AI
Compliance Impact

I don't know

Detection Guidance

I don't know

Mitigation Strategies

I don't know

Executive Summary

The vulnerability in wpForo Forum version 2.4.14 is a missing authorization flaw. It allows authenticated subscribers to close or reopen any forum topic by using the wpforo_close_ajax handler. Attackers can submit a valid nonce along with an arbitrary topic ID to bypass the moderator permission checks, enabling them to disrupt forum discussions.

Impact Analysis

This vulnerability can impact you by allowing unauthorized users with subscriber-level access to manipulate forum topics. They can close or reopen any topic without proper permissions, which can disrupt normal forum discussions and potentially degrade the user experience or the integrity of the forum content.

Chat Assistant
Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-28555. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70
EPSS Chart