Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
wpForo Forum 2.4.14 contains a missing authorization vulnerability that allows authenticated subscribers to approve or unapprove any forum post via the wpforo_approve_ajax AJAX handler. Attackers exploit the nonce-only check by submitting a valid nonce with an arbitrary post ID to bypass moderation controls entirely.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
NONE
Momentum
NONE
If you run products in this scope, you should treat this CVE as relevant to your environment.
CVE-2026-28554 Authenticated Post Moderation Bypass in wpForo Forum 2.4.14 https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-28554
Post summary
A new authenticated post moderation bypass vulnerability (CVE-2026-28554) has been disclosed for wpForo Forum 2.4.14, with details available on Vulmon.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | gvectors | wpforo_forum | - | wordpress | - |