Vulnerabilities / Discussion Board / WPSEC-2026-1593
Discussion Board <= 2.6.0 - Unauthenticated Sensitive Information Exposure of Restricted Topics via Search, Feeds and Sitemaps
Medium 5.3
CWE-200Fixed in 2.6.1
- ID
- WPSEC-2026-1593
- Plugin
- Discussion Board – WordPress Forum Plugin (wp-discussion-board)
- Affected
- all versions before 2.6.1
- Remediation
- Update to 2.6.1 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
- Weakness
- CWE-200
- Usage
- Plugin Low · Affected versions Low among sites WPSec scans, 2026-10-25
- Attack surface
- Discussion Board on WPSec AttackSurface
- Fix released
- Published
Description
The Discussion Board plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.6.0 due to viewer role restrictions only being enforced on single topic pages. This makes it possible for unauthenticated attackers to read discussion topics and replies restricted to specific roles through search results, RSS feeds, comment feeds, the Recent Comments widget and the XML sitemap.
References
- https://wpsec.com/vuln/WPSEC-2026-1593/
- https://plugins.svn.wordpress.org/wp-discussion-board/tags/2.6.1/
- https://wordpress.org/plugins/wp-discussion-board/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS