{
 "id": "WPSEC-2026-1593",
 "url": "https://wpsec.com/vuln/WPSEC-2026-1593/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-1593/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-1593/index.md",
 "title": "Discussion Board <= 2.6.0 - Unauthenticated Sensitive Information Exposure of Restricted Topics via Search, Feeds and Sitemaps",
 "description": "The Discussion Board plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.6.0 due to viewer role restrictions only being enforced on single topic pages. This makes it possible for unauthenticated attackers to read discussion topics and replies restricted to specific roles through search results, RSS feeds, comment feeds, the Recent Comments widget and the XML sitemap.",
 "plugin": {
  "slug": "wp-discussion-board",
  "name": "Discussion Board",
  "full_name": "Discussion Board – WordPress Forum Plugin",
  "wordpress_org": "https://wordpress.org/plugins/wp-discussion-board/",
  "advisories_url": "https://wpsec.com/vuln/plugin/wp-discussion-board/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/wp-discussion-board"
 },
 "type": "SENSITIVE DATA DISCLOSURE",
 "cwe": [
  "CWE-200"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 5.3,
  "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
  "severity": "Medium"
 },
 "affected": {
  "ranges": [
   {
    "from": null,
    "from_inclusive": true,
    "to": "2.6.1",
    "to_inclusive": false
   }
  ],
  "text": [
   "all versions before 2.6.1"
  ]
 },
 "introduced_in": null,
 "fixed_in": "2.6.1",
 "remediation": "Update to 2.6.1 or later.",
 "fix_released": "2026-10-23T09:03:03+00:00",
 "published": "2026-10-24T11:42:24+00:00",
 "updated": "2026-10-24T10:53:01.016440+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-1593/",
  "https://plugins.svn.wordpress.org/wp-discussion-board/tags/2.6.1/",
  "https://wordpress.org/plugins/wp-discussion-board/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/wp-discussion-board",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Low",
  "affected_versions": "Low",
  "as_of": "2026-10-25"
 }
}