CVE

CVE-2025-11452

7.5

CVSShigh

Exploitable remotely over the internet · no authentication required.

Description

The Asgaros Forum plugin for WordPress is vulnerable to SQL Injection via the '$_COOKIE['asgarosforum_unread_exclude']' cookie in all versions up to, and including, 3.1.0 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.

Attack Vector

Network

Privileges Req.

None

User Interaction

None

asgaros forum

Updated Nov 10, 2026View on NVD →

S4E scanner

highProduct Based Web Vulnerabilities~10 seconds

Asgaros Forum < 3.2.0 - SQL Injection

Asgaros Forum for WordPress versions prior to 3.2.0 is vulnerable to unauthenticated SQL injection through the asgarosforum_unread_exclude cookie. The cookie is JSON-decoded and its object keys are imploded into a NOT IN() clause without sanitisation. The vulnerable query only runs while rendering the forum page, so the payload must be sent there rather than to the site root. References: https://wpscan.com/vulnerability/e89f1f31-dc70-4ea5-b389-81c8be5b10c6/ https://plugins.trac.wordpress.org/browser/asgaros-forum/trunk/includes/forum-unread.php https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-11452 Remediation: Update Asgaros Forum to 3.2.0 or later.

url

Scanner page →Run scanner

CVE history: asgaros forum

Predict next CVE date with AI

Monitor this CVE on your assets

S4E maps published CVEs to scanners and forecasts the next disclosure window for your stack.

Create a free account →