CVE-2026-62137
MediumCVSS 5.3Exploitation Probability (EPSS)
Low risk8th percentile - higher than 8% of all known CVEs
Summary
The bbPress plugin in versions up to and including 2.6.14 exposes sensitive data to an unauthenticated attacker. This may lead to unauthorized access to information that should remain protected.
Risk Assessment
Sensitive data leakage may be used for further attacks, including privilege escalation or breach of forum users' privacy.
Recommendation
Update the bbPress plugin to a version newer than 2.6.14 as soon as a fix becomes available.
Other vulnerabilities in bbPress
See all- CVE-2026-110762Low
bbPress before 2.6.19 contains an information disclosure vulnerability that allows unauthenticated visitors to view restricted subforum posts because hide_sitewide ignores ancestor forum visibility. Topics and replies in public subforums nested under private or hidden parents expose title, permalink and body via the BuddyPress activity stream and REST endpoint.
- CVE-2026-74010Medium
A missing authorization vulnerability was found in bbPress (versions up to 2.6.14), allowing exploitation of incorrectly configured access control security levels. This can be used for unauthorized actions.
Original NVD description (English source)
Unauthenticated Sensitive Data Exposure in bbPress <= 2.6.14 versions.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS