Introduction
An attacker can read sensitive data from WordPress databases running wpForo Forum without logging in, by abusing how the plugin handles user-supplied parameters. wpForo has over 100,000 active installations, so this flaw reaches a wide range of community-driven sites.
wpForo Forum is a WordPress plugin that adds full forum features to sites of any size. Its large user base and tight WordPress integration make security issues here impactful.
Technical Information
CVE-2025-4203 is a high-severity SQL injection in the get_members() function of wpForo Forum, affecting all versions up to and including 2.4.8. The cause is missing integer validation on the 'offset' and 'row_count' parameters, which build a SQL LIMIT clause. The plugin escapes input with esc_sql(), but that function does not enforce numeric type safety. So an attacker can pass a crafted 'row_count' value that appends a PROCEDURE ANALYSE clause, using MySQL's grammar to run error-based or time-based SQL injection.
For example, the attacker can set 'row_count' to a value like:
1 PROCEDURE ANALYSE(extractvalue(rand(),concat(0x3a,version())),1)
This payload makes MySQL return an error message containing the database version, which the attacker can then read. The flaw needs no authentication and no special setup beyond a vulnerable version of wpForo running on MySQL.
You can review the vulnerable code in the plugin's public repository:
Affected Systems and Versions
- Product: wpForo Forum plugin for WordPress
- Affected versions: All versions up to and including 2.4.8
- Fixed in: 2.4.9
- Vulnerable in any configuration that uses MySQL as the backend
Vendor Security History
wpForo has patched several prior vulnerabilities in recent releases. The vendor responded to CVE-2025-4203 by shipping version 2.4.9 to fix the flaw. The root cause here, misusing esc_sql() and skipping strict input validation, has also shown up in other WordPress plugins, which points to a wider need for better secure coding practices across the ecosystem.
