Vulnerability · Published Feb 28, 2026 · Assigned by VulnCheck

CVE-2026-28559wpForo Forum 2.4.14 Information Disclosure via Global RSS Feed

Medium 5.3

In plain English

A medium-severity information exposure in wpForo Forum from gVectors Team. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 33% of all known vulnerabilities).

Severity (CVSS 3.1)5.3Medium

Exploit odds (30 days)0.4%top 66.6% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

wpForo Forum 2.4.14 contains an information disclosure vulnerability that allows unauthenticated users to retrieve private and unapproved forum topics via the global RSS feed endpoint. Attackers request the RSS feed without a forum ID parameter, bypassing the privacy and status WHERE clauses that are only applied when a specific forum ID is present in the query.

Affected products (as reported)

Vendor	Product	Versions
gVectors Team	wpForo Forum	2.4 – before 2.4.16

Weakness: CWE-200 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

References

wpForo Forum WordPress Plugin product
wpForo Forum Contributors & Developers patch
VulnCheck Advisory: wpForo Forum 2.4.14 Information Disclosure via Global RSS Feed third-party-advisory