The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report
Multiple SQL injection vulnerabilities in the WP-Forum plugin before 2.4 for WordPress allow remote attackers to execute arbitrary SQL commands via (1) the search_max parameter in a search action to the default URI, related to wpf.class.php; (2) the forum parameter to an unspecified component, related to wpf.class.php; (3) the topic parameter in a viewforum action to the default URI, related to the remove_topic function in wpf.class.php; or the id parameter in a (4) editpost or (5) viewtopic action to the default URI, related to wpf-post.php.
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Wp Forum Plugin | — | Update wp-forum plugin to version 2.4, or a newer patched version | May 15, 2025 | Sep 28, 2009 |
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub