CVE-2026-28556
Received Received - Intake

Authorization Bypass in wpForo Forum Allows Topic Manipulation

Publication date: 2026-02-28

Last updated on: 2026-03-04

Assigner: VulnCheck

Description
wpForo Forum 2.4.14 contains a missing authorization vulnerability that allows authenticated subscribers to move, merge, or split any forum topic via the topic_move, topic_merge, and topic_split form action handlers. Attackers with a valid form nonce can reorganize arbitrary forum content without moderator permissions, including relocating topics to private forums.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-02-28
Last Modified
2026-03-04
Generated
2026-07-06
AI Q&A
2026-03-01
EPSS Evaluated
2026-07-05
NVD
CVE-2026-28556
EUVD
EUVD-2026-9105

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
gvectors wpforo_forum From 2.4.0 (inc) to 2.4.16 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-862 The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

The vulnerability in wpForo Forum 2.4.14 is a missing authorization issue that allows authenticated subscribers to perform actions they should not be permitted to do. Specifically, these users can move, merge, or split any forum topic by exploiting the topic_move, topic_merge, and topic_split form action handlers.

Attackers who have a valid form nonce can reorganize forum content arbitrarily without needing moderator permissions, including moving topics into private forums.

Impact Analysis

This vulnerability can impact you by allowing unauthorized users with subscriber-level access to manipulate forum content in unintended ways. They can move, merge, or split topics without proper permissions, potentially disrupting forum organization and user experience.

Additionally, attackers can relocate topics to private forums, which may expose sensitive discussions or cause confusion among forum members.

Compliance Impact

I don't know

Detection Guidance

I don't know

Mitigation Strategies

I don't know

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-28556. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart