The vulnerability allows an unauthenticated attacker to inject arbitrary SQL through the Topics::get_topics() function. The flaw stems from the ORDER BY clause that applies ineffective esc_sql() sanitization to unquoted identifiers, letting attackers supply a crafted wpfob parameter containing CASE WHEN statements. Successful exploitation enables blind boolean extraction, allowing the attacker to read credentials and other sensitive data from the WordPress database, thereby compromising confidentiality and potentially granting further unauthorized access.

The affected product is the wpForo Forum WordPress plugin developed by the gVectors Team, specifically version 2.4.14. Users running this plugin version on any WordPress installation are at risk, while later releases such as 2.4.15 are not affected.

The CVSS score of 8.8 indicates a high severity, but the EPSS score of less than 1% suggests that exploitation attempts are currently uncommon. The vulnerability is not listed in the CISA KEV catalog. Attackers can trigger the flaw via a simple unauthenticated HTTP request that supplies the vulnerable wpfob parameter, meaning that any external user could potentially abuse it without authentication.