Medium severity · published Feb 28, 2026
CVE-2026-28559
wpForo Forum 2.4.14 Information Disclosure via Global RSS Feed
5.3
CVSS
0.4%
EPSS
No
On KEV
Description
wpForo Forum 2.4.14 contains an information disclosure vulnerability that allows unauthenticated users to retrieve private and unapproved forum topics via the global RSS feed endpoint. Attackers request the RSS feed without a forum ID parameter, bypassing the privacy and status WHERE clauses that are only applied when a specific forum ID is present in the query.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
Low
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 33% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
WF
wpForo Forum · gVectors Team
2.4 before 2.4.16 · source: vendor, NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-28559
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-28559
Product
https://wordpress.org/plugins/wpforo/
Release Notes
https://wordpress.org/plugins/wpforo/#developers
Third Party Advisory
https://www.vulncheck.com/advisories/wpforo-forum-information-disclosure-via-global-rss-feed
More from wpForo Forum
9.8
CVE-2026-28562
wpForo Forum 2.4.14 SQL Injection via Topics ORDER BY Parameter
8.8
CVE-2023-47870
WordPress wpForo Forum Plugin <= 2.2.6 is vulnerable to Broken Access Control and Cross Site Request Forgery (CSRF)
8.1
CVE-2024-43288
WordPress wpForo Forum plugin <= 2.3.4 - Insecure Direct Object References (IDOR) vulnerability
7.5
CVE-2024-43289
WordPress wpForo Forum plugin <= 2.3.4 - Unauthenticated Sensitive Data Exposure vulnerability
6.5
CVE-2026-28557
wpForo Forum < 2.4.16 Privilege Escalation via Role Synchronization Handler