The wpForo Forum plugin for WordPress allows authenticated attackers with Subscriber-level access or higher to perform a SQL Injection through the Subscriptions Manager. The injection arises from insufficient escaping of user‑supplied input and the absence of proper preparation of the underlying SQL query. An attacker can append additional SQL statements to the existing query, enabling extraction of sensitive database information such as user credentials or private content. The primary consequence is the compromise of data confidentiality and potential exposure of privileged information within the WordPress site. This weakness is classified as CWE‑89, indicating an SQL Injection flaw.

The vulnerability affects WordPress sites that use the wpForo Forum plugin, version 2.4.9 or older. Administrators should verify the plugin version on their installations and identify if they are running an affected release. The problem resides specifically in the Subscriptions Manager module of the plugin.

The CVSS score of 6.5 indicates a moderate severity, but the EPSS score of less than 1% reflects a low probability of exploitation at the time of analysis. The weakness is not listed in the CISA KEV catalog. Attackers must first authenticate to the WordPress site with at least Subscriber role and then use the subscriptions functionality to craft the injection payload. While no public exploits are documented, the limited access requirements and the nature of stored SQL injection make exploitation feasible on compromised or poorly secured sites.