Title: wpForo Forum 2.4.14 Missing Authorization via Topic Close AJAX Handler Severity: MEDIUM Date: 2/28/2026 CVE ID: CVE-2026-28555 CVE Details URL: [CVE Details URL] CVSS v4 Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N References: - wpForo Forum WordPress Plugin - wpForo Forum Contributors & Developers Vulnerability Description: wpForo Forum 2.4.14 contains a missing authorization vulnerability that allows authenticated subscribers to close or reopen any forum topic via the wpforo_close_ajax handler. Attackers submit a valid nonce with an arbitrary topic ID to bypass the moderator permission requirement and disrupt forum discussions. Credit: Scott Moore - VulnCheck