Threats tagged 'ghsa-v485-7xgw-37qq'

The wpForo Forum plugin for WordPress versions up to and including 3.2.2 is vulnerable to a time-based SQL Injection via the 'href[locale]' parameter. This vulnerability arises from insufficient escaping of user input and inadequate preparation of the SQL query. An unauthenticated attacker can exploit this flaw to append additional SQL queries, potentially extracting sensitive database information. Exploitation requires a nonce that is publicly available to unauthenticated visitors on any forum page, meaning no login or prior interaction is necessary.