WPForo Forum - SQLi (CVE-2026-1581)

CVE-2026-1581 is a vulnerability in the wpForo Forum plugin for WordPress that allows unauthenticated attackers to perform time-based SQL injection via the 'wpfob' parameter. This flaw enables malicious actors to manipulate database queries and potentially extract sensitive information from the underlying database, posing a significant risk to the confidentiality of user data.

CrowdSec has been tracking this vulnerability and its exploits since 1st of April 2026.

According to CrowdSec data, while opportunistic exploitation dominates, a portion of threat actors trying to exploit CVE-2026-1581 apply basic targeting methods such as port or service detection. This indicates emerging patterns of selective targeting. Data from the CrowdSec community also indicates a gradual decrease in attacks targeting CVE-2026-1581. While still present in the wild, exploitation levels have dropped noticeably week-over-week. This may signal that the vulnerability is becoming less relevant or that defenses are improving fast enough for attackers to lose interest.

Attackers exploit the /community/recent/ endpoint by injecting SQL commands into the wpfob parameter, often using time-based payloads to extract sensitive database information from vulnerable wpForo Forum installations.