{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"wpForo Forum","vendor":"tomdever","versions":[{"lessThanOrEqual":"2.4.8","status":"affected","version":"0","versionType":"semver"}]}],"source":"security@wordfence.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"The wpForo Forum plugin for WordPress is vulnerable to error‐based or time-based SQL Injection via the get_members() function in all versions up to, and including, 2.4.8 due to missing integer validation on the 'offset' and 'row_count' parameters. The function blindly interpolates 'row_count' into a 'LIMIT offset,row_count' clause using esc_sql() rather than enforcing numeric values. MySQL 5.x’s grammar allows a 'PROCEDURE ANALYSE' clause immediately after a LIMIT clause. Unauthenticated attackers controlling 'row_count' can append a stored‐procedure call, enabling error‐based or time‐based blind SQL injection that can be used to extract sensitive information from the database."},{"lang":"es","value":"El plugin wpForo Forum para WordPress es vulnerable a inyección SQL basada en errores o basada en tiempo a través de la función get_members() en todas las versiones hasta la 2.4.8, inclusive, debido a la falta de validación de enteros en los parámetros 'offset' y 'row_count'. La función interpola ciegamente 'row_count' en una cláusula 'LIMIT offset,row_count' usando esc_sql() en lugar de forzar valores numéricos. La gramática de MySQL 5.x permite una cláusula 'PROCEDURE ANALYSE' inmediatamente después de una cláusula LIMIT. Atacantes no autenticados que controlan 'row_count' pueden añadir una llamada a procedimiento almacenado, lo que permite una inyección SQL ciega basada en errores o basada en tiempo que puede usarse para extraer información sensible de la base de datos."}],"id":"CVE-2025-4203","lastModified":"2026-10-08T11:10:00.250","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":7.5,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","version":"3.1"},"exploitabilityScore":3.9,"impactScore":3.6,"source":"security@wordfence.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2025-4203","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2025-10-27T15:37:16.653419Z","version":"2.0.3"}}]},"published":"2025-10-25T07:15:41.130","references":[{"source":"security@wordfence.com","url":"https://plugins.trac.wordpress.org/browser/wpforo/tags/2.4.5/classes/Members.php#L1557"},{"source":"security@wordfence.com","url":"https://plugins.trac.wordpress.org/browser/wpforo/tags/2.4.9/classes/Members.php#L1557"},{"source":"security@wordfence.com","url":"https://wordpress.org/plugins/wpforo/#developers"},{"source":"security@wordfence.com","url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bc406e8a-c4eb-45c3-a53c-37644e0dabfa?source=cve"}],"sourceIdentifier":"security@wordfence.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-89"}],"source":"security@wordfence.com","type":"Secondary"}]}