CVE-2026-28559 describes an information disclosure vulnerability in gVectors Team's wpForo Forum version 2.4.14. The issue arises from the global RSS feed endpoint, which allows unauthenticated users to retrieve private and unapproved forum topics by omitting the forum ID parameter in their request. The privacy and status WHERE clauses intended to restrict access are only enforced when a forum ID is specified, enabling unauthorized data exposure otherwise. This vulnerability affects version 2.4 of the product and has a CVSS 4.0 score of 6.9, reflecting a medium severity level.

Unauthorized actors can retrieve private and unapproved forum topics without authentication by exploiting the RSS feed endpoint. This leads to exposure of sensitive forum content that should be restricted. There is no indication of privilege escalation, code execution, or other impacts beyond information disclosure. No known exploits have been reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, consider restricting access to the RSS feed endpoint or disabling the global RSS feed functionality if possible to prevent unauthorized data exposure.