A time-based SQL injection in the wpForo forum plugin is being used against WordPress sites that have not moved to version 3.2.3. The attacker does not need an account: the request token the exploit requires is printed on any public forum page.
What happened
Wordfence, which assigned the identifier, traces the flaw to insufficient escaping and missing query preparation on the href[locale] parameter that wpForo uses when it builds board URLs. Because the value is pasted into an existing statement, an attacker can append extra SQL and read the result back through response timing rather than a visible error.
The action is protected by a nonce, but that nonce is handed to unauthenticated visitors inside the wpforo.nonces JavaScript object on forum pages. Loading one public page is enough to obtain it, so registration and user interaction play no part.
The CVE-2026-119155 record rates the bug CVSS 7.5 with no privileges and no user interaction required. Patchstack, which tracks WordPress plugin exploitation, scores it 9.3 and lists it as known to be exploited, with 20,000 or more active installations in scope.
Who is affected
Exposure is not limited to large communities. Any site keeping the plugin active is a candidate, including forums that were set up for one campaign and never removed.
- WordPress sites running wpForo Forum 3.2.2 or earlier
- Sites with a publicly reachable forum page, since the nonce is served to guests
- Hosting setups where the WordPress database user holds broad grants across other schemas
What to do now
Update wpForo Forum to 3.2.3 or later, confirm the version on disk, then purge page, object and CDN caches so cached pages stop serving the old JavaScript.
- Check the installed version with WP-CLI and update the plugin, not just the theme or core
- Search web server and database logs for repeated slow responses on wpForo endpoints in short bursts
- If activity looks suspicious, rotate the database password and the WordPress salts, reset administrator passwords and invalidate sessions
- Where the patch cannot go in today, deactivate the plugin or block public access to forum routes
What this means for South African businesses
Forums are usually bolted onto a marketing site by a web developer and then forgotten, which means the plugin sits unpatched for years while the site itself gets updated. The database it reads is the same one holding the administrator password hashes, so a successful dump is a direct route to full site takeover rather than a data nuisance.
In our experience most South African SME sites run on shared hosting where the database user is far more privileged than a forum needs, which makes the blast radius larger than the plugin suggests. A site inventory that lists plugins, not just domains, is the only way to catch this class of exposure.
Source: Wordfence threat intelligence record for CVE-2026-119155.
Also on the blog
Next step: If this is on your network or a client's, ask Matthews Enterprises to check exposure.