CVE-2026-28555 is a missing authorization vulnerability in gVectors Team's wpForo Forum 2.4.14. Authenticated users with subscriber-level privileges can exploit the wpforo_close_ajax handler to close or reopen any forum topic without having moderator rights. The vulnerability arises because the handler accepts a valid nonce and arbitrary topic ID but does not verify the user's permission to perform these actions, allowing unauthorized modification of forum topics.

An attacker with subscriber-level access can disrupt forum discussions by closing or reopening topics arbitrarily. This can lead to denial of service to legitimate forum users by preventing or enabling access to topics without proper authorization. There is no indication of data disclosure or privilege escalation beyond topic state manipulation.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict subscriber permissions where possible or monitor forum topic state changes for unauthorized activity. Avoid granting unnecessary privileges to authenticated users.