CVE-2026-28557

The vulnerability CVE-2026-28557 affects wpForo Forum 2.4.14, due to a missing capability check in the wpforo_synch_roles AJAX handler. Any authenticated user can access the usergroups admin page to obtain a nonce and bulk-remap all wpForo usergroups to arbitrary WordPress roles, enabling privile...

PT-2026-22478

Name of the Vulnerable Software and Affected Versions wpForo Forum version 2.4.14 Description An issue exists in wpForo Forum that allows authenticated users to perform bulk wpForo usergroup reassignment. This is possible due to a missing capability check in the wpforo synch roles AJAX handler. A...