Back Redpacketsecurity HackerOne Bug Bounty Disclosure: information-disclosure-unauthen-leak-private-content-truong-nguyen
A bug in bbPress’s BuddyPress activity integration could expose posts from a restricted forum. When a subforum was marked public but sat inside a private or hidden parent forum, bbPress checked only the subforum’s status—not the privacy settings of its parent forums. As a result, a topic or could appear in the public BuddyPress activity stream even though its own page was inaccessible.
Unauthenticated visitors could retrieve the activity stream through the BuddyPress API and see the leaked content, including post titles, forum details, links, and the full text of topics or replies. The report demonstrated that a topic could return a 404 on its own page while its content remained visible in the public feed. Posting content in the forum was needed to trigger the issue, but reading the exposed activity did not require authentication.
Affected software and fix
The report tested WordPress 7.1.2, BuddyPress 14.5.2, and bbPress 2.6.18. The bbPress team confirmed the issue and committed a fix with regression tests to bbPress trunk (revision 7628) and the 2.6 maintenance branch (revision 7629). The change makes the activity integration account for parent forums when checking whether content should be public.
WordPress marked the report resolved after confirming the issue and implementing the fix. The report was later disclosed.
A considerable amount of time and effort goes into maintaining this website, creating backend automation and creating new features and content for you to make actionable intelligence decisions. Everyone that supports the site helps enable new functionality.
If you like the site, please support us on Patreon or Buy Me A Coffee using the buttons below.
HackerOne report summary
Programme
Submitted by Truong Nguyen Long
Profile
Report title Information Disclosure – Unauthen Leak Private Content
Report link
Date submitted 2026-10-10T17:55:44.655Z
A bug in bbPress’s BuddyPress activity integration could expose posts from a restricted forum. When a subforum was marked public but sat inside a private or hidden parent forum, bbPress checked only the subforum’s status—not the privacy settings of its parent forums. As a result, a topic or could appear in the public BuddyPress activity stream even though its own page was inaccessible.
Unauthenticated visitors could retrieve the activity stream through the BuddyPress API and see the leaked content, including post titles, forum details, links, and the full text of topics or replies. The report demonstrated that a topic could return a 404 on its own page while its content remained visible in the public feed. Posting content in the forum was needed to trigger the issue, but reading the exposed activity did not require authentication.
Affected software and fix
The report tested WordPress 7.1.2, BuddyPress 14.5.2, and bbPress 2.6.18. The bbPress team confirmed the issue and committed a fix with regression tests to bbPress trunk (revision 7628) and the 2.6 maintenance branch (revision 7629). The change makes the activity integration account for parent forums when checking whether content should be public.
WordPress marked the report resolved after confirming the issue and implementing the fix. The report was later disclosed.
A considerable amount of time and effort goes into maintaining this website, creating backend automation and creating new features and content for you to make actionable intelligence decisions. Everyone that supports the site helps enable new functionality.
If you like the site, please support us on Patreon or Buy Me A Coffee using the buttons below.
The full story
This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.
