Security notice
Run a WordPress forum with wpForo? Someone without a login can try to read your site's database. Update to 3.2.3 or later today.
wpForo Forum, a WordPress forum plugin, has CVE-2026-119155 in versions 3.2.2 and earlier. It is an unauthenticated SQL injection: someone without a login can send crafted requests that try to read information out of your site's database, which can hold user accounts, email addresses and private forum content. Patchstack rates it 9.3 and marks it as known to be exploited. Wordfence rates it 7.5. The fix is version 3.2.3. WordPress.org currently offers 3.2.5. If you use this plugin, update to 3.2.3 or later today, preferably the latest version. If you cannot update, deactivate the plugin until you can. (Patchstack, Nov 6, Wordfence, WordPress.org)
What happened
- The flaw. CVE-2026-119155 affects the wpForo Forum plugin for WordPress in versions 3.2.2 and earlier. It is an unauthenticated SQL injection in how the plugin handles board URL information. Someone without a login can try to read information from the site's database. (Patchstack, Wordfence)
- Known to be exploited, per Patchstack. Patchstack marks this vulnerability as known to be exploited. That is Patchstack's own assessment. (Patchstack)
- Severity. Patchstack rates it CVSS 9.3. Wordfence rates it 7.5 (high). (Patchstack, Wordfence)
- The fix. The official changelog for version 3.2.3, dated November 1, 2026, lists a fix for an SQL injection in board URL handling, along with other security fixes. WordPress.org currently offers 3.2.5, dated November 13, 2026, which includes further security fixes. Update to the latest version. (WordPress.org plugin changelog)
- Install base. WordPress.org lists 20,000+ active installations. That is not a count of sites that are still on a vulnerable version, and it is not a count of sites that have been attacked. (WordPress.org)
Who should worry
Any WordPress site running wpForo Forum 3.2.2 or earlier. If you do not use this plugin, this notice does not apply to you.
What to do now
- Update wpForo Forum to 3.2.3 or later today, preferably the latest version. WordPress.org currently offers 3.2.5. Back up the site and database first. In WordPress admin, go to Plugins, Installed Plugins, and confirm the installed version even if automatic updates are enabled or your host manages updates. (Patchstack, WordPress.org)
- After updating, clear caches. The plugin's changelog asks you to delete all caches and purge a CDN if you use one, and to flush Redis object cache if that cache is enabled. (WordPress.org plugin changelog)
- If the update has to wait, deactivate the plugin until you can install the fixed version. This takes the forum offline, so tell users how they can reach you in the meantime.
- Check for signs of tampering. Look for unexpected new administrator or user accounts, changed passwords, odd posts or settings, and strange database activity. Updating closes the flaw; it does not undo access an attacker may already have gained.
- If you find signs of a break-in, change passwords, tell affected users, and ask your developer or host to investigate.
What to send your developer, agency or host
Please check whether our WordPress site runs the wpForo Forum plugin. CVE-2026-119155 affects wpForo Forum versions 3.2.2 and earlier; it is an unauthenticated SQL injection that can expose database contents, fixed in 3.2.3. Patchstack rates it 9.3 and marks it as known to be exploited. Wordfence rates it 7.5. WordPress.org currently offers 3.2.5. Please update us to the latest version today, or deactivate the plugin until the update can be installed, then clear caches as the changelog directs, check for unexpected accounts or database activity, and confirm the version you left us on. Sources: Patchstack, Wordfence, WordPress.org, NVD.
Common questions
Does this mean my site was hacked?
No. A vulnerable version is a reason to update and review the site, not proof of a break-in. Patchstack marks this flaw as known to be exploited, so do not wait.
Can EverThread tell me if I am affected?
No. EverThread does not test for this. We cannot see which WordPress plugins your site runs or which versions they are on. A scan without a warning about this plugin does not mean your site is safe.
Which version should I install?
3.2.3 is the first version that fixes this SQL injection. WordPress.org currently offers 3.2.5, which includes further security fixes. Install the latest version. (WordPress.org)
Where can I follow updates?
Follow Patchstack, Wordfence, the NVD entry and the WordPress.org plugin page. All current notices are on our notices page.
Security alerts by email
Hear about the next one first.
When a flaw puts websites at risk, we send one email: what happened, who it affects and what to do. It's free, whether or not you use EverThread.
Sources
- Patchstack: CVE-2026-119155, affected wpForo Forum versions 3.2.2 and earlier, patched in 3.2.3, CVSS 9.3, marked as known to be exploited, published November 6, 2026.
- Wordfence: CVE-2026-119155, unauthenticated SQL injection in versions 3.2.2 and earlier, patched in 3.2.3, rated 7.5.
- WordPress.org plugin page: current version 3.2.5, 20,000+ active installations, changelog for 3.2.3 (November 1, 2026) and 3.2.5 (November 13, 2026).
- NVD: CVE-2026-119155 record.
- WPDeeply, November 12, 2026: additional public write-up of the same advisory.