Cross-Site Request Forgery Vulnerability in bbPress Plugin for WordPress

CVE-2025-1435

Summary

The bbPress plugin for WordPress contains a Cross-Site Request Forgery vulnerability that affects all versions up to and including 2.6.11. This flaw arises from inadequate nonce validation in the bbp_user_add_role_on_register() function. As a result, unauthenticated attackers can gain administrative privileges by tricking site administrators into triggering malicious requests. To mitigate the issue, the plugin has removed the ability to select user roles during the registration process, but the absence of proper nonce checks still leaves the system vulnerable.

References