Threats tagged 'ghsa-wf5q-4vh3-9chv'

The wpForo Forum plugin for WordPress contains an SQL Injection vulnerability in the Subscriptions Manager component affecting all versions up to and including 2.4.9. This flaw allows authenticated users with Subscriber-level access or higher to inject additional SQL queries by exploiting insufficient escaping and lack of proper query preparation on user-supplied input. The vulnerability can be used to extract sensitive information from the database without requiring user interaction.