The vulnerability allows unauthenticated users to retrieve private and unapproved forum topics by requesting the global RSS feed endpoint without supplying a forum ID. When the forum ID parameter is omitted, the privacy and status WHERE clauses that normally filter hidden or unapproved content are bypassed, exposing sensitive user data. The loss of confidentiality exposes personal data contained within those topics to anyone with internet access.

The wpForo Forum plugin by the gVectors Team is affected. All installations running version 2.4.14 or earlier are vulnerable. Version 2.4.16 and later contain the fix, preventing the privacy filters from being bypassed.

The CVSS score of 6.9 reflects a medium‑to‑high severity if exploited. The EPSS score of less than 1% indicates that, as of this analysis, the probability of widespread exploitation is low. The vulnerability is not listed in the CISA KEV catalog. Attackers can trigger the issue by simply issuing an unauthenticated HTTP GET request to rss.php without the forum ID parameter; no authentication or special configuration is required.