CVE-2026-28556 is a missing authorization vulnerability in wpForo Forum 2.4.14. Authenticated users with subscriber-level privileges can perform administrative actions such as moving, merging, or splitting forum topics via the topic_move, topic_merge, and topic_split form action handlers. These actions normally require moderator permissions, but due to the missing authorization checks, attackers can manipulate forum content arbitrarily if they possess a valid form nonce.

An attacker with subscriber-level access and a valid form nonce can reorganize forum topics without proper authorization, potentially disrupting forum structure and confidentiality by relocating topics to private forums. This could lead to unauthorized access to restricted content or confusion among forum users. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict subscriber access where possible and monitor for unusual topic reorganization activities. Avoid sharing valid form nonces with untrusted users. Follow vendor updates closely for an official patch or temporary workaround.