The vulnerability is an unauthenticated SQL injection in the WordPress wpForo Forum plugin for versions 3.0.4 and earlier. An attacker who can send crafted input to the forum can inject arbitrary SQL statements, potentially reading, modifying, or deleting data from the database. This flaw, classified as CWE-89, can lead to loss of confidential data and compromise of database integrity, with a high possibility of turning into a full database compromise or influencing site operation.

Any WordPress site that has the Tomdever wpForo Forum plugin installed on a version 3.0.4 or older is affected. The plugin is widely used, so any site running those versions is at risk.

The CVSS score of 9.3 marks this as critical. The EPSS score of less than 1% indicates it is not among the most frequently exploited vulnerabilities, and it is not listed in the CISA KEV catalog. The attack vector is assumed to unauthenticated, exploiting input fields in the forum module. An attacker would need to access the forum pages, send a specially crafted request, and rely on the plugin’s lack of input validation to execute arbitrary SQL. Because the flaw is unauthenticated, the barrier to exploitation is low and the potential impact is high.