CVE-2026-5097: CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') in tomdever wpForo Forum

CVE-2026-5097 is an SQL Injection vulnerability in the wpForo Forum WordPress plugin affecting versions up to 2.4.17. The flaw arises from improper neutralization of special elements in the 'referer' parameter, allowing unauthenticated attackers to append malicious SQL commands to existing queries. This is caused by insufficient escaping of user input and lack of prepared statements in the affected code. The vulnerability can be exploited remotely without authentication, potentially exposing sensitive database information. The CVSS 3.1 base score is 7.5, indicating high severity. No known exploits in the wild or vendor patches have been reported as of the published date.

An unauthenticated attacker can exploit this vulnerability to perform SQL Injection attacks via the 'referer' parameter, enabling unauthorized data extraction from the database. The impact is limited to confidentiality as integrity and availability are not affected according to the CVSS vector. This could lead to exposure of sensitive information stored in the database backing the wpForo Forum plugin.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider disabling or restricting access to the vulnerable plugin or parameter to mitigate risk. Monitoring for updates from the vendor or trusted security sources is recommended.