CVE-2026-1581

DiscoveredFeb 19, 2026UpdatedApr 15, 2026

The wpForo Forum plugin for WordPress is vulnerable to time-based SQL Injection via the 'wpfob' parameter in all versions up to, and including, 2.4.14 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.

View graph Watch Export

CVSS v3.1

7.5 HIGH

EPSS

2.51%

probability of exploitation in 30 days

CISA KEV

Not listed

no confirmed exploitation reported

News coverage

sources referencing this CVE

Related IOCs

seen in the same coverage

EPSS Trend

Aug 16, 2026 → Oct 22, 2026

▲ 0.78pp

1.73% → 2.51% over 3 tracked changes

CVSS v3.1 Detail

Attack VectorNETWORK

Attack ComplexityLOW

Privileges RequiredNONE

User InteractionNONE

ScopeUNCHANGED

ConfidentialityHIGH

IntegrityNONE

AvailabilityNONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Connections

4 relationships

CWE-89

source

Timeline

disclosure → media coverage

Feb 19, 2026

Disclosure — published as a CVE record. · last revised by NVD Apr 15, 2026

Oct 1, 2026

thehackernews.com reports: WordPress Backdoor Rebuilds Itself After Cleanup Using Files, Database, and Shared Memory

Public PoC (1)

github.com/rootdirective-sec/CVE-2026-1581-Analysis-Lab

Unverified third-party code — review before executing.