CVE-2026-110762
LowCVSS 3.7Summary
bbPress before 2.6.19 contains an information disclosure vulnerability that allows unauthenticated visitors to view restricted subforum posts because hide_sitewide ignores ancestor forum visibility. Topics and replies in public subforums nested under private or hidden parents expose title, permalink and body via the BuddyPress activity stream and REST endpoint.
Risk Assessment
Unauthenticated users can access content that should be restricted, leading to information leakage from private or hidden forums.
Recommendation
Update bbPress to version 2.6.19 or later to fix the ancestor forum visibility issue.
Other vulnerabilities in bbPress
See all- CVE-2026-62137Medium
The bbPress plugin in versions up to and including 2.6.14 exposes sensitive data to an unauthenticated attacker. This may lead to unauthorized access to information that should remain protected.
- CVE-2026-74010Medium
A missing authorization vulnerability was found in bbPress (versions up to 2.6.14), allowing exploitation of incorrectly configured access control security levels. This can be used for unauthorized actions.
Original NVD description (English source)
bbPress before 2.6.19 contains an information disclosure vulnerability that allows unauthenticated visitors to view restricted subforum posts because hide_sitewide ignores ancestor forum visibility. Topics and replies in public subforums nested under private or hidden parents expose title, permalink and body via the BuddyPress activity stream and REST endpoint.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS