CVE-2026-74010: WordPress bbPress plugin <= 2.6.14 - Broken Access Control vulnerability
Published Aug 31, 2026
·Updated
Missing Authorization vulnerability in John James Jacoby bbPress allows Exploiting Incorrectly Configured Access Control Security Levels.
This issue affects bbPress: from n/a through 2.6.14.
Affected Software
1 affected component
John James Jacoby bbPress<=2.6.14
Event History
Aug 31, 2026
CVE Published
via MITRE·12:07 PM
Data Sourced
via MITRE·12:07 PM
DescriptionSeverityWeakness
Frequently Asked Questions
1
Which bbPress versions are affected?
The issue affects bbPress versions through 2.6.14. The available data does not identify a fixed version.
2
Can this be exploited remotely without an account or user interaction?
Yes. The CVSS vector indicates network-based exploitation with low attack complexity, no privileges required, and no user interaction required.
3
What is the likely security impact?
The listed impact is limited to integrity, meaning an attacker may be able to make unauthorized modifications. No confidentiality or availability impact is indicated by the provided CVSS vector.