The wpForo Forum plugin for WordPress is vulnerable to an unauthenticated SQL Injection attack. The flaw resides in the post_args and topic_args parameters, which are insufficiently sanitized and incorporated directly into SQL queries. An attacker can inject arbitrary SQL statements, enabling extraction of sensitive data from the database. This is a classic CWE-89 weakness that allows attackers to read confidential information.

The vulnerability affects any WordPress site that has installed the wpForo Forum plugin by tomdever, versions up to and including 2.4.12. Sites running these versions, regardless of geographic location or user role, are susceptible because the flaw can be triggered by any unauthenticated user through publicly accessible endpoints.

The CVSS score of 7.5 indicates high severity, but the EPSS score of less than 1% suggests that actual exploitation is currently unlikely. The vulnerability is not listed in the CISA KEV catalog, and no exploit code is publicly available. Attackers would need to target publicly accessible WordPress installations where the wpForo plugin is active and craft requests to the vulnerable post_args or topic_args endpoints. Given the potential to expose sensitive data, the risk remains significant for affected sites.