The Asgaros Forum plugin for WordPress contains an unauthenticated SQL injection vulnerability. The flaw is triggered by crafting a special value for the 'asgarosforum_unread_exclude' cookie, which is concatenated into a database query without proper escaping or use of prepared statements. An attacker can therefore inject arbitrary SQL statements, enabling the retrieval of sensitive information such as user accounts and forum content from the database. This weakness is classified as CWE-89.

All installations of Asgaros Forum version 3.1.0 and earlier running on WordPress are affected. Sites that have not upgraded the plugin to version 3.1.1 or newer carry this vulnerability. No other vendors or product lines are listed as impacted.

The vulnerability carries a CVSS score of 7.5, indicating high severity, while the EPSS score is below 1% and it is not listed in CISA's KEV catalog, reflecting a low current exploitation probability. Exploitation requires only the ability to set an HTTP cookie; no user authentication is required. Once a payload is executed, the attacker can read data from the database but cannot execute arbitrary code or gain system-level control.