MEDIUM 6.3 NVD
CVE-2026-110762
bbPress before 2.6.19 contains an information disclosure vulnerability that allows unauthenticated visitors to view restricted subforum posts because hide_sitew
bbPress before 2.6.19 contains an information disclosure vulnerability that allows unauthenticated visitors to view restricted subforum posts because hide_sitewide ignores ancestor forum visibility. Topics and replies in public subforums nested under private or hidden parents expose title, permalink and body via the BuddyPress activity stream and REST endpoint.
References
- https://bbpress.org/blog/2026/09/bbpress-2-6-19-is-out/
- https://github.com/bbpress/bbPress/blob/04c6f1513c6ca34e849ca16015b7a08b3c15e753/src/inclu
- https://github.com/bbpress/bbPress/commit/5dce23a0b23a22d32c45b96fd44588952b16fe8a
- https://wordpress.org/plugins/bbpress/
- https://www.vulncheck.com/advisories/bbpress-before-2.6.19-information-disclosure-via-budd
This medium severity vulnerability with a CVSS score of 6.3 was published on 2026-10-14 via NVD.
vulnfeed aggregates 15189 vulnerabilities from NVD, CISA KEV,
Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.