Vulnerabilities / bbPress
bbPress vulnerabilities
Advisories WPSec published for bbPress. Other sources may list more. Its attack surface: bbPress on WPSec AttackSurface.
| Published | ID | Vulnerability | Severity | Fixed in |
|---|---|---|---|---|
| 2026-10-16 | WPSEC-2026-1120 | bbPress <= 2.6.19 - Unauthenticated Sensitive Information Exposure via Forum Attachments | Medium 5.3 | 2.6.20 |
| 2026-10-16 | WPSEC-2026-1119 | bbPress <= 2.6.19 - Unauthenticated Sensitive Information Exposure via Single Reply Pages | Medium 5.3 | 2.6.20 |
| 2026-10-16 | WPSEC-2026-1118 | bbPress <= 2.6.19 - Authenticated (Subscriber+) Missing Authorization to Topic and Reply Creation in Password-Protected Forums | Medium 4.3 | 2.6.20 |
| 2026-10-01 | WPSEC-2026-0025 | bbPress <= 2.6.18 - Unauthenticated Sensitive Information Exposure via oEmbed Endpoint and Canonical Redirect | Medium 5.3 | 2.6.19 |
| 2026-10-01 | WPSEC-2026-0024 | bbPress <= 2.6.18 - Authenticated (Contributor+) Sensitive Information Exposure via Single Topic and Single Reply Shortcodes | Medium 4.3 | 2.6.19 |
| 2026-10-01 | WPSEC-2026-0023 | bbPress <= 2.6.18 - Unauthenticated Sensitive Information Exposure via Password-Protected Forum and Topic Bypass | Medium 5.3 | 2.6.19 |
License: CC BY 4.0