The wpForo Forum plugin for WordPress is vulnerable to a time-based SQL injection flaw that can be triggered via the "wpfob" parameter. The vulnerability results from inadequate escaping and the absence of prepared statement usage for user‑supplied input, allowing attackers to append malicious SQL code to existing queries. Once exploited, unauthenticated attackers can extract sensitive database information, which directly compromises confidentiality. This flaw is categorized as CWE‑89.

The affected product is the wpForo Forum plugin (tomdever). All versions up to and including 2.4.14 are vulnerable; later releases are not listed as affected. Users running any legacy instance of the plugin fall within the risk scope.

The CVSS score of 7.5 indicates a high severity, while an EPSS score of 9% suggests a low to moderate likelihood of exploitation. The vulnerability is not recorded in the CISA KEV catalog. The attack vector is unauthenticated and remote, requiring only crafted HTTP requests targeting the "wpfob" parameter. Exploitation can be achieved without special credentials, making the threat landscape significant for publicly accessible WordPress sites.