← Vulnerability feed

Vulnerability record · CVE-2026-28557 · published 28 February 2026

CVE-2026-28557: Gvectors wpforo forum missing authorization vulnerability

Gvectors · Wpforo Forum

wpForo Forum 2.4.14 contains a missing capability check vulnerability that allows authenticated users to trigger bulk wpForo usergroup reassignment via the wpforo_synch_roles AJAX handler. Attackers access the usergroups admin page, accessible to any authenticated user, to obtain a nonce, then remap all wpForo usergroups to arbitrary WordPress roles.

7.1 CVSS 4.0 High EPSS 0.40% · top 68.9% CWE-862 · Missing authorization
7.1CVSS 4.0 base score
0.40%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
3References
17 Jun 2026Last modified by NVD

Description

wpForo Forum 2.4.14 contains a missing capability check vulnerability that allows authenticated users to trigger bulk wpForo usergroup reassignment via the wpforo_synch_roles AJAX handler. Attackers access the usergroups admin page, accessible to any authenticated user, to obtain a nonce, then remap all wpForo usergroups to arbitrary WordPress roles.

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
https://wordpress.org/plugins/wpforo/ Product
https://wordpress.org/plugins/wpforo/#developers Release Notes
https://www.vulncheck.com/advisories/wpforo-forum-privilege-escalation-via-role-synchronization-handler Third Party Advisory

Track CVE-2026-28557 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

9.8CVE-2023-47868Gvectors wpforo forum improper privilege management vulnerabilityImproper Privilege Management vulnerability in wpForo wpForo Forum allows Privilege Escalation.This issue affects wpForo Forum: from n/a through 2.2.…EPSS 0.48%9.8CVE-2018-16613Gvectors wpforo forum vulnerabilityAn issue was discovered in the update function in the wpForo Forum plugin before 1.5.2 for WordPress. A registered forum is able to escalate privileg…EPSS 2.7%8.8CVE-2026-28562Gvectors wpforo forum sql injection vulnerabilitywpForo 2.4.14 contains an unauthenticated SQL injection vulnerability in Topics::get_topics() where the ORDER BY clause relies on ineffective esc_sql…EPSS 0.52%8.8CVE-2023-47870Gvectors wpforo forum cross-site request forgery vulnerabilityCross-Site Request Forgery (CSRF), Missing Authorization vulnerability in gVectors Team wpForo Forum wpforo allows Cross Site Request Forgery, Access…EPSS 0.27%8.8CVE-2023-2249wpForo Forum plugin LFI, SSRF and PHAR deserialization via file_get_contentsThe wpForo Forum plugin for WordPress up to and including 2.1.7 passes attacker-controlled data to file_get_contents without proper verification, ena…EPSS 61%analysed8.8CVE-2022-40200Gvectors wpforo forum unrestricted file upload vulnerabilityAuth. (subscriber+) Arbitrary File Upload vulnerability in wpForo Forum plugin <= 2.0.9 on WordPress.EPSS 0.96%8.8CVE-2022-40192Gvectors wpforo forum cross-site request forgery vulnerabilityCross-Site Request Forgery (CSRF) vulnerability in wpForo Forum plugin <= 2.0.9 on WordPress.EPSS 0.48%8.8CVE-2022-38144Gvectors wpforo forum cross-site request forgery vulnerabilityCross-Site Request Forgery (CSRF) vulnerability in gVectors Team wpForo Forum plugin <= 2.0.5 at WordPress.EPSS 0.51%

Source: NIST National Vulnerability Database (record CVE-2026-28557), CISA KEV, FIRST EPSS (scores of 2026-09-27). This page is refreshed as NVD updates the record.