/Vulnerability Library

Asgaros Forum < 3.2.0 - SQL Injection

CVE-2025-11452
Early Release

Description

Asgaros Forum for WordPress versions prior to 3.2.0 is vulnerable to unauthenticated SQL injection through the asgarosforum_unread_exclude cookie. The cookie is JSON-decoded and its object keys are imploded into a NOT IN() clause without sanitisation. The vulnerable query only runs while rendering the forum page, so the payload must be sent there rather than to the site root.

Severity

High

CVSS Score

7.5

Exploit Probability

0%

Affected Product

asgaros-forum

Published Date

August 15, 2026

Template Author

pauullamm

CVE-2025-11452.yaml
7.5Score

CVSS Metrics

CVSS Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CVE ID:
cve-2025-11452
CWE ID:
cwe-89

References

https://wpscan.com/vulnerability/e89f1f31-dc70-4ea5-b389-81c8be5b10c6/https://plugins.trac.wordpress.org/browser/asgaros-forum/trunk/includes/forum-unread.phphttps://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-11452

Remediation Steps

Update Asgaros Forum to 3.2.0 or later.