Skip to content
Information Disclosure in bbPress via WordPress REST API Vulnerabilities

Information Disclosure in bbPress via WordPress REST API Vulnerabilities

First seen 12 Oct 2026, 19:31 UTC • •
API

Article Content

Browse articles
ThreatCluster AI
ThreatCluster •October 12, 2026 at 20:31 UTC
  • •Two vulnerabilities in bbPress allow unauthorized access to private forum content.
  • •The issues affect bbPress 2.7 and earlier versions, with fixes already implemented.
  • •No active exploitation has been reported for these vulnerabilities.

Two vulnerabilities in bbPress, reported by Winston Crooker and Truong Nguyen Long, allow unauthenticated access to private forum content. The first vulnerability, disclosed on 2026-10-12, enables attackers to read private posts via the WordPress REST API due to insufficient visibility checks. The second, reported on 2026-10-10, exposes posts from restricted forums in the public BuddyPress activity stream when subforums are incorrectly configured. Both issues affect bbPress 2.7 and earlier versions, with fixes committed to the development and maintenance branches. The vulnerabilities were confirmed and resolved, with the WordPress team doubling the bounty for the earlier report. No has been confirmed for either issue.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Updated just now How this analysis works

Timeline

2026-10-10
Information disclosure vulnerability reported
Truong Nguyen Long reported a bug in bbPress's BuddyPress integration exposing restricted forum content.
Redpacketsecurity
2026-10-12
Unauthenticated disclosure vulnerability reported
Winston Crooker disclosed a vulnerability allowing access to private forum posts via the WordPress REST API.
Redpacketsecurity

More articles in this cluster (2)

Extracted Entities (6)

1 / 3

Common questions

Which versions of bbPress are affected?
bbPress 2.7 and earlier versions are affected by the reported vulnerabilities.
Have these vulnerabilities been exploited in the wild?
No active exploitation has been reported for these vulnerabilities.
What fixes have been implemented?
The bbPress team has committed fixes to both the development and maintenance branches to address the vulnerabilities.