Wp Forum Vulnerabilities

The WP Forum plugin for WordPress is vulnerable to blind SQL Injection via the ‘topic’ parameter in versions up to, and including, 2.4 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers to append a...

CVSS:

9.8

Affected:

up to 2.4

Fix:

No patched version reported

Disclosed:

May 15, 2015

Multiple SQL injection vulnerabilities in the WP-Forum plugin before 2.4 for WordPress allow remote attackers to execute arbitrary SQL commands via (1) the search_max parameter in a search action to the default URI, related to wpf.class.php; (2) the forum parameter to an unspecified component, related to wpf.class.php;...

CVSS:

9.8

Affected:

up to 2.4

Fixed in:

2.4

Disclosed:

Sep 28, 2009

CVE-2009-3703 on NVD →

SQL injection vulnerability in the WP-Forum 1.7.4 plugin for WordPress allows remote attackers to execute arbitrary SQL commands via the user parameter in a showprofile action to the default URI.

CVSS:

9.8

Affected:

up to 1.7.4

Fixed in:

1.7.7

Disclosed:

Jan 19, 2008

CVE-2008-0388 on NVD →