WordPress WP Forum Server Plugin <= 1.7.4 - SQL Injection

Because of this vulnerability, the attackers can execute arbitrary SQL commands via the “user” parameter in a showprofile action to the default URI.

Solution

           Update the plugin.