The wpForo Forum plugin for WordPress is vulnerable to an unauthenticated SQL injection flaw caused by insufficient escaping of the 'data' parameter in legacy versions. This weakness, identified as CWE-89, allows an attacker to influence the database query constructed by the plugin and append additional SQL statements. The consequence is the potential extraction of sensitive data from the forum database, compromising confidentiality and possibly integrity if destructive queries are injected.

The vulnerability affects the wpForo Forum plugin provided by tomdever, impacting all releases up to and including version 3.2.1. Users who have not upgraded beyond 3.2.1 and are running WordPress sites with this plugin are exposed. No specific operating system or WordPress core version restrictions are mentioned.

The scoring indicates a high severity (CVSS 7.5) but the EPSS value is unavailable, so the current likelihood of exploitation cannot be quantified from the data provided. The vulnerability is not listed in the CISA KEV catalog, suggesting that widespread exploitation may not yet be observed. However, the attack vector is inferred to be remote, as the 'data' parameter is exposed through HTTP requests to the plugin. The fact that unauthenticated users can trigger the flaw means that anyone with network access to the site can potentially access the forum database by exploiting a configured searchable checkbox or multi‑choice field.