CVE-2026-110762

Deferred Deferred - Pending Action

bbPress Information Disclosure in Subforums

Publication date: 2026-10-14

Last updated on: 2026-10-14

Assigner: VulnCheck

Description

bbPress before 2.6.19 contains an information disclosure vulnerability that allows unauthenticated visitors to view restricted subforum posts because hide_sitewide ignores ancestor forum visibility. Topics and replies in public subforums nested under private or hidden parents expose title, permalink and body via the BuddyPress activity stream and REST endpoint.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-14

Last Modified

2026-10-14

Generated

2026-10-19

AI Q&A

2026-10-15

EPSS Evaluated

2026-10-18

NVD

CVE-2026-110762

EUVD

EUVD-2026-101562

Affected Vendors & Products

Vendor	Product	Version / Range
bbPress	bbPress	0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-863	The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.

Attack-Flow Graph

Executive Summary

This vulnerability in bbPress before 2.6.19 allows unauthenticated visitors to view restricted subforum posts. It occurs because the hide_sitewide function fails to check the visibility of ancestor forums properly. As a result, topics and replies in public subforums nested under private or hidden parent forums are exposed through the BuddyPress activity stream and REST endpoint, including their titles, permalinks, and bodies.

Detection Guidance

Check if your bbPress version is below 2.6.19 by running: wp plugin list | grep bbpress. Inspect BuddyPress activity streams for exposed restricted posts. Review REST API responses for subforum content under private parents using curl commands like curl -X GET https://your-site.com/wp-json/bbpress/v1/topics.

Impact Analysis

Unauthenticated users could access sensitive information from restricted forums, such as private discussions or sensitive topics, through public activity streams or REST endpoints. This could lead to unauthorized data exposure, privacy breaches, or compliance violations if confidential information is disclosed.

Compliance Impact

This vulnerability could violate GDPR by exposing personal data without consent and HIPAA by disclosing protected health information. Organizations using affected bbPress versions may face legal penalties, reputational damage, and loss of trust due to unauthorized data exposure.

Mitigation Strategies

Update bbPress to version 2.6.19 or later immediately via WordPress dashboard or command line: wp plugin update bbpress. Verify the update with wp plugin list | grep bbpress. Ensure WordPress 6.0+ and PHP 7.2+ are installed as required by the update.

Hi! I’m here to help you understand CVE-2026-110762. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70