The wpForo Forum plugin for WordPress contains a time‑based SQL injection flaw in the 'href[locale]' request parameter. Because the input is not properly escaped and the SQL statement is not prepared, attackers can include malicious SQL commands that are executed by the database. The result is an unauthenticated ability to extract any database table contents, gain administrative credentials, or otherwise exfiltrate or modify sensitive data, presenting a clear breach of confidentiality and integrity. This condition is identified as CWE‑89.

The affected product is the wpForo Forum plugin supplied by Tom Dever. All releases up to and including version 3.2.2 are vulnerable; the issue was fixed in version 3.2.3 and later. WordPress sites running any of the affected releases and exposing a public forum page are potentially impacted.

The likely attack vector is an unauthenticated HTTP request to the forum page where the 'href[locale]' parameter is parsed. Based on the description, it is inferred that the attacker can obtain the required nonce, which is publicly emitted on any forum page, without any prior authentication or interaction. The CVSS score of 7.5 reflects a high likelihood of successful exploitation, and although the EPSS score is not available, the absence from the CISA KEV catalog suggests it has not yet been widely exploited. The lack of server‑side filtering means that an attacker can immediately insert malicious payloads.