Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
wpForo Forum 2.4.14 contains a missing authorization vulnerability that allows authenticated subscribers to move, merge, or split any forum topic via the topic_move, topic_merge, and topic_split form action handlers. Attackers with a valid form nonce can reorganize arbitrary forum content without moderator permissions, including relocating topics to private forums.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
NONE
Momentum
NONE
If you run products in this scope, you should treat this CVE as relevant to your environment.
CVE-2026-28556 Authenticated Topic Manipulation Vulnerability in wpForo Forum 2.4.14 https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-28556
Post summary
A new authenticated topic manipulation vulnerability (CVE-2026-28556) has been disclosed for wpForo Forum 2.4.14, with minimal technical details provided.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | gvectors | wpforo_forum | - | wordpress | - |