Vulnerabilities / bbPress / WPSEC-2026-0024
bbPress <= 2.6.18 - Authenticated (Contributor+) Sensitive Information Exposure via Single Topic and Single Reply Shortcodes
Medium 4.3
CWE-200Fixed in 2.6.19
- ID
- WPSEC-2026-0024
- Plugin
- bbPress (bbpress)
- Affected
- all versions before 2.6.19
- Remediation
- Update to 2.6.19 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
- Weakness
- CWE-200
- Usage
- Plugin Medium · Affected versions Medium among sites WPSec scans, 2026-10-22
- Attack surface
- bbPress on WPSec AttackSurface
- Fix released
- Published
Description
The bbPress plugin for WordPress is vulnerable to Sensitive Information Exposure via the bbp-single-topic and bbp-single-reply shortcodes in all versions up to, and including, 2.6.18. The shortcodes check the forum's visibility but not whether the topic or reply itself is public before rendering it. This makes it possible for authenticated attackers with contributor-level access and above to embed the shortcodes in a post and preview it, to view pending, spam or trashed replies, and replies under unapproved topics, that they are not permitted to read.
References
- https://wpsec.com/vuln/WPSEC-2026-0024/
- https://plugins.svn.wordpress.org/bbpress/tags/2.6.19/
- https://wordpress.org/plugins/bbpress/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS