Information Disclosure Vulnerability in bbPress by Automattic
CVE-2026-110762

6.3MEDIUM

Key Information:

Vendor

Bbpress

Status
Bbpress
Vendor
CVE Published:
14 October 2026

What is CVE-2026-110762?

bbPress versions prior to 2.6.19 are susceptible to an information disclosure vulnerability. This flaw allows unauthenticated users to view content from restricted subforums. Specifically, the issue arises from the hide_sitewide function, which fails to consider the visibility settings of ancestor forums. As a result, topics and replies within public subforums that are nested under private or hidden parent forums can leak their titles, permalinks, and bodies through the BuddyPress activity stream and REST endpoint.

Affected Version(s)

bbPress 0 < 2.6.19

References

https://bbpress.org/blog/2026/09/bbpress-2-6-19-is-out/
release-notes
https://github.com/bbpress/bbPress/commit/5dce23a0b23a22d...
patch
https://github.com/bbpress/bbPress/blob/04c6f1513c6ca34e8...
technical-description

CVSS V4

Score:
6.3
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Truong Nguyen Long (thewindghost)
Nguyen Minh Tuan (m3mories)
.