CVE-2026-28559

MediumCVSS 5.3/10Last modified Jun 17, 2026

Description

wpForo Forum 2.4.14 contains an information disclosure vulnerability that allows unauthenticated users to retrieve private and unapproved forum topics via the global RSS feed endpoint. Attackers request the RSS feed without a forum ID parameter, bypassing the privacy and status WHERE clauses that are only applied when a specific forum ID is present in the query.

Metrics

CVSS 3.1 5.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-200

Affected software

No affected versions have been published.

Timeline

Published: Feb 28, 2026
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-28568.8A vulnerability was found in D-Link DWR-M960 1.01.07. Affected by this vulnerability is the function sub_424AFC of the file /boafrm/formFilt CVE-2026-285604.8wpForo Forum 2.4.14 contains a stored cross-site scripting vulnerability that allows script injection via forum URL data output into an inli CVE-2026-285614.8wpForo Forum 2.4.14 contains a stored cross-site scripting vulnerability that allows administrators to inject persistent JavaScript via foru CVE-2026-285629.8wpForo 2.4.14 contains an unauthenticated SQL injection vulnerability in Topics::get_topics() where the ORDER BY clause relies on ineffectiv CVE-2026-285634.3Apache Airflow versions 3.1.0 through 3.1.7 /ui/dependencies endpoint returns the full DAG dependency graph without filtering by authorized CVE-2026-285649.8Insufficient Session Expiration, Authentication Bypass by Capture-replay vulnerability in Apache IoTDB. REST Basic Authentication Accepts St CVE-2026-285677.5Unauthenticated Broken Access Control in WP Sort Order <= 1.3.5 versions.CVE-2026-285687.1Unauthenticated Cross Site Scripting (XSS) in Quill Forms <= 5.7.1 versions.CVE-2026-285697.1Unauthenticated Cross Site Scripting (XSS) in SSL Zen <= 4.7.43 versions.CVE-2026-28578.8A vulnerability was determined in D-Link DWR-M960 1.01.07. Affected by this issue is the function sub_423E00 of the file /boafrm/formPortFw CVE-2026-285708.1Unauthenticated Local File Inclusion in Vavo Core <= 2.3.0 versions.CVE-2026-285717.5Unauthenticated Broken Access Control in FormyChat <= 2.15.7 versions.