CVE-2026-74010
MediumCVSS 5.3Exploitation Probability (EPSS)
Low risk7th percentile - higher than 7% of all known CVEs
Summary
A missing authorization vulnerability was found in bbPress (versions up to 2.6.14), allowing exploitation of incorrectly configured access control security levels. This can be used for unauthorized actions.
Risk Assessment
An attacker can exploit the missing authorization to perform operations without proper permissions, potentially leading to forum integrity compromise or access to sensitive data.
Recommendation
Update bbPress to the latest version that includes the fix. Additionally, review permission configuration and ensure it is correctly set.
Other vulnerabilities in bbPress
See all- CVE-2026-110762Low
bbPress before 2.6.19 contains an information disclosure vulnerability that allows unauthenticated visitors to view restricted subforum posts because hide_sitewide ignores ancestor forum visibility. Topics and replies in public subforums nested under private or hidden parents expose title, permalink and body via the BuddyPress activity stream and REST endpoint.
- CVE-2026-62137Medium
The bbPress plugin in versions up to and including 2.6.14 exposes sensitive data to an unauthenticated attacker. This may lead to unauthorized access to information that should remain protected.
Original NVD description (English source)
Missing Authorization vulnerability in John James Jacoby bbPress allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects bbPress: from n/a through 2.6.14.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS