CVE-2025-1435: bbPress <= 2.6.11 - Cross-Site Request Forgery to Limited Privilege Escalation

Published Mar 5, 2025
·
Updated

The bbPress plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.6.11. This is due to missing or incorrect nonce validation on the bbpuseraddroleonregister() function. This makes it possible for unauthenticated attackers to elevate their privileges to that of a bbPress Keymaster via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. Rather than implementing a nonce check to provide protection against this vulnerability, which would break functionality, the plugin no longer makes it possible to select a role during registration.

Affected Software

1 affected component
bbPress bbPress<=2.6.11

Event History

Mar 5, 2025
CVE Published
via MITRE·08:21 AM
Data Sourced
via MITRE·08:21 AM
DescriptionSeverityWeakness
Data Sourced
via NVD·09:15 AM
DescriptionSeverityWeakness

Frequently Asked Questions

1

What is the severity of CVE-2025-1435?

CVE-2025-1435 has a high severity rating due to its potential for exploitation by unauthenticated attackers.

2

How do I fix CVE-2025-1435?

To fix CVE-2025-1435, update the bbPress plugin to the latest version above 2.6.11 where the vulnerability is patched.

3

Who is affected by CVE-2025-1435?

All versions of the bbPress plugin for WordPress up to and including 2.6.11 are affected by CVE-2025-1435.

4

What type of vulnerability is CVE-2025-1435?

CVE-2025-1435 is classified as a Cross-Site Request Forgery (CSRF) vulnerability.

5

Can CVE-2025-1435 lead to unauthorized actions on my WordPress site?

Yes, CVE-2025-1435 can allow unauthenticated attackers to perform unauthorized actions on your WordPress site.

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203