What is CVE-2026-28559?

CVE-2026-28559 is a medium-severity vulnerability in Gvectors Wpforo Forum, classified under Information Disclosure. CVSS score: 5.3/10. Published 2026-02-28.

How severe is CVE-2026-28559?

Medium severity. CVSS v3 base score is 5.3 out of 10.

Information disclosure in Gvectors Wpforo Forum

CVE-2026-28559

wpForo Forum 2.4.14 contains an information disclosure vulnerability that allows unauthenticated users to retrieve private and unapproved forum topics via the global RSS feed endpoint. Attackers request the RSS feed without a forum ID parameter, bypassing the privacy and status WHERE clauses that are only applied when a specific forum ID is present in the query.

Vulnerability class: Information Disclosure

EPSS: 0.003 (26.2th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 5.3 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N.

Affected products

Gvectors Wpforo_forum
Gvectors Team Wpforo Forum — versions 2.4, 2.4.16

Weakness classification (CWE)

CWE-200 — Information Disclosure

References

disclosure@vulncheck.com (Product, product)
disclosure@vulncheck.com (Release Notes, patch)
disclosure@vulncheck.com (Third Party Advisory, third-party-advisory)

Frequently asked questions

What is CVE-2026-28559?: CVE-2026-28559 is a medium-severity vulnerability in Gvectors Wpforo Forum, classified under Information Disclosure. CVSS score: 5.3/10. Published 2026-02-28.
How severe is CVE-2026-28559?: Medium severity. CVSS v3 base score is 5.3 out of 10.