CVE-2026-5097

wpForo Forum, a WordPress forum plugin, is vulnerable to unauthenticated SQL injection (CVE-2026-5097) through the 'referer' parameter in all versions up to and including 2.4.17. Because the user-supplied value is insufficiently escaped and used in a SQL query without proper preparation, a remote, unauthenticated attacker can append additional SQL queries onto existing database queries. Successful exploitation can expose sensitive information stored in the site's WordPress database, such as user account data, and requires no privileges or user interaction. Any WordPress site running wpForo Forum 2.4.17 or earlier is affected. No public proof-of-concept or confirmed in-the-wild exploitation is known; EPSS currently estimates only a 0.4% probability of exploitation within 30 days.

What to do: Update wpForo Forum to the latest patched release (any version newer than 2.4.17; check the plugin listing for the current fixed version). Until patched, apply WAF/CDN rules that validate or normalize the referer input and review access logs for requests carrying unusual referer values alongside database activity. No public PoC is known, so prioritize internet-facing sites with the plugin's registration or forum endpoints exposed.