CVE-2026-28555 reveals a missing authorization flaw in wpForo Forum 2.4.14 that lets any authenticated subscriber close or reopen any forum topic. Attackers can submit a valid nonce together with an arbitrary topic ID to the wpforo_close_ajax handler, bypassing the intended moderator permission checks and disrupting discussions. This flaw is a classic example of CWE‑862: missing authorization for operations.

The vulnerability affects the wpForo Forum plugin from gVectors Team. The only documented vulnerable version is 2.4.14, and any installation running this version is at risk. No evidence is provided that later releases contain a fix or that previous releases (prior to 2.4.14) are affected. Admins should verify the version in use and consult vendor release notes for remediation.

The CVSS score of 5.3 indicates moderate severity, and the EPSS score of less than 1% suggests a low likelihood of exploitation in the wild. The issue is not listed in the CISA KEV catalog. Exploitation requires the attacker to be an authenticated subscriber with a valid session; the attacker then crafts an AJAX request to the wpforo_close_ajax endpoint. If the site hosts many subscribers, the attack surface expands, but the need for prior authentication limits the risk relative to remote code execution vulnerabilities.