The wpForo Forum plugin for WordPress allows attackers without authentication to inject arbitrary SQL statements by sending a specially crafted request that includes a malicious value for the HTTP referer header. The plugin fails to escape or prepare this input before embedding it directly into database queries. Consequently, an attacker can append additional SELECT statements or other commands to the existing query and read information from the database, potentially exposing user credentials, posts, and configuration data.

This vulnerability exists in all releases of the wpForo Forum plugin up to and including version 2.4.17. The plugin is a popular forum solution integrated into WordPress sites, used by site administrators to provide discussion functionality on their blogs and websites.

The vulnerability has a CVSS score of 7.5, indicating moderate to high severity. The EPSS score is not reported, and the issue is not listed in the CISA KEV catalog, suggesting the exploitation likelihood has not been formalized. Based on the description, the likely attack vector is a web request that supplies a crafted referer header, allowing an unauthenticated attacker to manipulate the query and extract data from the underlying database.