Description
wpForo Forum 是 WordPress 上一款功能强大的社区论坛插件，为 WordPress 网站提供完整的论坛解决方案，支持用户讨论、话题管理、私信通知、社交功能等多种特性，被广泛应用于各类社区和网站。该插件的 /community/recent/ 接口存在 SQL 注入漏洞，攻击者可以通过 wpfob 参数注入恶意 SQL 语句，利用时间盲注技术获取数据库敏感信息。
Wordpress wpForo Forum /community/recent/ SQL 注入漏洞（CVE-2026-1581）
PoC
None yet. Search at https://trap.biu.life/?ref=rssReferences
https://nvd.nist.gov/vuln/detail/CVE-2026-1581
https://github.com/advisories/GHSA-3rcw-598c-wmjr
https://www.sentinelone.com/vulnerability-database/cve-2026-1581/
https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/wpforo/wpforo-forum-2414-unauthenticated-time-based-sql-injection
https://pentest-tools.com/vulnerabilities-exploits/wpforo-forum-2414-sql-injection_29049
https://freshysites.com/security-bulletins/wordpress-security-bulletin-wpforo-forum-plugin-vulnerability-cve-2026-1581/
https://app.opencve.io/cve/CVE-2026-1581
https://www.momosec.cn/vulnerability