CVE-2025-1435: bbPress <= 2.6.11 - Cross-Site Request Forgery to Limited Privilege Escalation
The bbPress plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.6.11. This is due to missing or incorrect nonce validation on the bbpuseraddroleonregister() function. This makes it possible for unauthenticated attackers to elevate their privileges to that of a bbPress Keymaster via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. Rather than implementing a nonce check to provide protection against this vulnerability, which would break functionality, the plugin no longer makes it possible to select a role during registration.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-1435?
CVE-2025-1435 has a high severity rating due to its potential for exploitation by unauthenticated attackers.
How do I fix CVE-2025-1435?
To fix CVE-2025-1435, update the bbPress plugin to the latest version above 2.6.11 where the vulnerability is patched.
Who is affected by CVE-2025-1435?
All versions of the bbPress plugin for WordPress up to and including 2.6.11 are affected by CVE-2025-1435.
What type of vulnerability is CVE-2025-1435?
CVE-2025-1435 is classified as a Cross-Site Request Forgery (CSRF) vulnerability.
Can CVE-2025-1435 lead to unauthorized actions on my WordPress site?
Yes, CVE-2025-1435 can allow unauthenticated attackers to perform unauthorized actions on your WordPress site.