The wpForo Forum plugin is vulnerable to unauthenticated SQL Injection because the get_members() function does not perform integer validation on the 'offset' and 'row_count' parameters. The parameters are interpolated directly into a LIMIT clause, allowing attackers to inject MySQL’s PROCEDURE ANALYSE call, which leads to error‑based or time‑based blind SQL injection. Attackers can exploit this to extract sensitive data from the database, compromising confidentiality.

The vulnerability affects the WordPress plugin wpForo Forum from vendor tomdever. All releases up to and including version 2.4.8 are impacted; versions 2.4.9 and later contain a fix.

The CVSS score of 7.5 indicates a moderate‑to‑high risk level. The EPSS score of less than 1% suggests that, at present, exploitation is unlikely, but the vulnerability remains actionable from unauthenticated HTTP requests, as the attack vector is inferred from the exposed get_members endpoint. The vulnerability is not listed in the CISA KEV catalog, indicating no publicly known exploitation in the wild yet. However, attackers with access to the site can craft malicious payloads in the URL or form fields to trigger data extraction.