CVE-2026-28562 is an unauthenticated SQL injection vulnerability in wpForo Forum 2.4.14, specifically in the Topics::get_topics() method. The issue stems from improper neutralization of special elements in the ORDER BY clause, where esc_sql() sanitization is ineffective on unquoted identifiers. Attackers can exploit the wpfob parameter by injecting CASE WHEN payloads to perform blind boolean extraction attacks, potentially exposing credentials stored in the WordPress database. The vulnerability has a CVSS 4.0 score of 8.8, indicating high severity and network exploitable without privileges or user interaction.

Successful exploitation allows remote attackers to perform blind boolean SQL injection attacks without authentication, potentially extracting sensitive credential information from the WordPress database. This can lead to unauthorized data disclosure and compromise of the affected system's confidentiality.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider disabling or restricting access to the vulnerable wpForo Forum 2.4.14 component or applying custom input validation and filtering on the wpfob parameter to mitigate exploitation risk.