bbPress vulnerabilities

bbPress before 2.6.19 contains an information disclosure vulnerability that allows unauthenticated visitors to view restricted subforum posts because hide_sitewide ignores ancestor forum visibility. Topics and replies in public subforums nested under private or hidden parents expose title, permalink and body via the BuddyPress activity stream and REST endpoint.

The bbPress plugin in versions up to and including 2.6.14 exposes sensitive data to an unauthenticated attacker. This may lead to unauthorized access to information that should remain protected.

A missing authorization vulnerability was found in bbPress (versions up to 2.6.14), allowing exploitation of incorrectly configured access control security levels. This can be used for unauthorized actions.