Back Redpacketsecurity HackerOne Bug Bounty Disclosure: unauthenticated-disclosure-of-private-and-hidden-forum-content-in-bbpress-via-the-wordpress-core-rest-single-item-endpoint-winston
Report title Unauthenticated disclosure of private and hidden forum content in bbPress via the WordPress core REST single-item endpoint
Report link
Date submitted 2026-10-12T06:53:02.416Z
A bug in the development version of bbPress 2.7 allowed anyone—even without an account—to read topics and replies from private or hidden forums through specific WordPress REST API URLs. The forum’s normal pages and REST listings blocked access, but requests for individual posts by ID did not.
bbPress exposed its forums, topics, and replies to the REST API to support features such as editing. Its visibility checks filtered forum listings, but the WordPress endpoint for retrieving a single post skipped those checks. Since topics and replies were stored as published posts, the endpoint returned their content to anonymous visitors.
What could an attacker do?
An unauthenticated attacker could guess or enumerate post IDs and retrieve the full text of topics and replies in private or hidden forums. The issue affected the bbPress 2.7 development version; the released 2.6 series was not exposed by default because its post types were not enabled for the REST API.
The bbPress team added a REST controller that checks forum visibility for individual posts and collections, including content within restricted parent forums. The fix also protects certain related attachments. It was committed to the 2.7 development line as r7481 and backported to the 2.6 branch as r7482, covering sites that enable REST support through custom code.
The report was validated, fixed, and resolved. WordPress confirmed that the bounty would be doubled because the issue was reported before bbPress 2.7 was released.
A considerable amount of time and effort goes into maintaining this website, creating backend automation and creating new features and content for you to make actionable intelligence decisions. Everyone that supports the site helps enable new functionality.
If you like the site, please support us on Patreon or Buy Me A Coffee using the buttons below.
HackerOne report summary
Programme
Submitted by Winston Crooker
Profile
Report title Unauthenticated disclosure of private and hidden forum content in bbPress via the WordPress core REST single-item endpoint
Report link
Date submitted 2026-10-12T06:53:02.416Z
A bug in the development version of bbPress 2.7 allowed anyone—even without an account—to read topics and replies from private or hidden forums through specific WordPress REST API URLs. The forum’s normal pages and REST listings blocked access, but requests for individual posts by ID did not.
bbPress exposed its forums, topics, and replies to the REST API to support features such as editing. Its visibility checks filtered forum listings, but the WordPress endpoint for retrieving a single post skipped those checks. Since topics and replies were stored as published posts, the endpoint returned their content to anonymous visitors.
What could an attacker do?
An unauthenticated attacker could guess or enumerate post IDs and retrieve the full text of topics and replies in private or hidden forums. The issue affected the bbPress 2.7 development version; the released 2.6 series was not exposed by default because its post types were not enabled for the REST API.
The bbPress team added a REST controller that checks forum visibility for individual posts and collections, including content within restricted parent forums. The fix also protects certain related attachments. It was committed to the 2.7 development line as r7481 and backported to the 2.6 branch as r7482, covering sites that enable REST support through custom code.
The report was validated, fixed, and resolved. WordPress confirmed that the bounty would be doubled because the issue was reported before bbPress 2.7 was released.
A considerable amount of time and effort goes into maintaining this website, creating backend automation and creating new features and content for you to make actionable intelligence decisions. Everyone that supports the site helps enable new functionality.
If you like the site, please support us on Patreon or Buy Me A Coffee using the buttons below.
The full story
This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.
