wpForo Forum Information Disclosure Vulnerability in RSS Feed

An information disclosure vulnerability exists in wpForo Forum version 2.4.14. This vulnerability allows unauthenticated users to access private and unapproved forum topics through the global RSS feed endpoint. The issue arises because the RSS feed can be requested without a specific forum ID, bypassing the privacy and status checks that would normally prevent such access.

Impact

Exploitation of this vulnerability allows unauthorized users to access sensitive forum content that is meant to be private or unapproved.

Remediation

Users can update to wpForo Forum version 2.4.16, which addresses this vulnerability by adding permission checks for post approval and topic management actions, and by fixing the RSS feed issue that exposed private and unapproved content.