Multiple SQL injection vulnerabilities in the WP-Forum plugin before 2.4 for WordPress allow remote attackers to execute arbitrary SQL comma

Affected versions

NVD version ranges (for catalog products). Add the product to your stack with a version and matching uses these.

• fahlstad wp-forumup to 2.2 inclusive
• fahlstad wp-forum1.5
• fahlstad wp-forum1.6
• fahlstad wp-forum1.7
• fahlstad wp-forum1.7.3
• fahlstad wp-forum1.7.4
• fahlstad wp-forum1.7.8
• fahlstad wp-forum1.8
• fahlstad wp-forum2.0
• fahlstad wp-forum2.1

Other highest-scoring records for the same primary product.

• CVE-2026-63030WordPress < 7.0.2 - REST API batch-route confusion and SQL injection issue leading to Remote Code ExecutionKEV
  72This week
• CVE-2026-87902An unauthenticated attacker can make `get_page_template()` page-template resolution include a chosen readable local `.php` file outside the KEV
  68This week
• CVE-2019-8942WordPress before 4.9.9 and 5.x before 5.0.1 allows remote code execution because an _wp_attached_file Post Meta entry can be changed to an a
  60This week
• CVE-2022-21661SQL injection in WordPress
  59Plan
• CVE-2026-60137WordPress < 7.0.2 - Facilitated SQL Injection via author__not_in in WP_QueryKEV
  55Plan
• CVE-2017-1001000The register_routes function in wp-includes/rest-api/endpoints/class-wp-rest-posts-controller.php in the REST API in WordPress 4.7.x before
  55Plan

FIRST EPSS daily score; only changes of 0.01 or more are recorded (step chart).

Root cause

The query text is built by concatenating user input. The database cannot tell where the data ends and the command begins.

A representative example of this vulnerability class. Not the vendor's source code; it shows the faulty pattern and its fix.

1const owner = req.query.owner;2const rows = await db.query(3  "SELECT * FROM files WHERE owner = '" + owner + "'"4);

1const owner = req.query.owner;2const rows = await db.query(3  "SELECT * FROM files WHERE owner = $1",4  [owner]5);

Attack context

MITRE CAPEC attack patterns and ATT&CK techniques for this weakness class (CWE). A starting point for detection rules and threat hunting.