CVE-2026-110762: bbPress before 2.6.19 Information Disclosure via BuddyPress Activity Stream
bbPress before 2.6.19 contains an information disclosure vulnerability that allows unauthenticated visitors to view restricted subforum posts because hidesitewide ignores ancestor forum visibility. Topics and replies in public subforums nested under private or hidden parents expose title, permalink and body via the BuddyPress activity stream and REST endpoint.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
bbPressto a version that resolves this vulnerability.Fixed in 2.6.19
Event History
Frequently Asked Questions
Which deployments are exposed to this disclosure?
Deployments using bbPress before 2.6.19 are exposed when a public subforum is nested beneath a private or hidden parent forum and BuddyPress activity is available. The affected content includes topics and replies from those subforums.
Does an attacker need an account or user interaction to retrieve the exposed content?
No. The issue can be exploited by unauthenticated visitors without user interaction. Exposed activity data is available through the BuddyPress activity stream and REST endpoint.
What information can be disclosed?
The activity stream can expose the title, permalink, and body of topics and replies posted in a public subforum whose ancestor forum is private or hidden.
What can be done while an update is pending?
Avoid placing public subforums beneath private or hidden parent forums, and restrict access to the BuddyPress activity stream and REST endpoint where feasible. These measures reduce exposure of activity entries associated with the affected forum hierarchy.