# Discussion Board <= 2.6.0 - Unauthenticated Sensitive Information Exposure of Restricted Topics via Search, Feeds and Sitemaps

- **ID:** WPSEC-2026-1593
- **Plugin:** Discussion Board – WordPress Forum Plugin (`wp-discussion-board`), https://wordpress.org/plugins/wp-discussion-board/
- **Affected versions:** all versions before 2.6.1
- **Fixed in:** 2.6.1 (Update to 2.6.1 or later.)
- **Severity:** Medium 5.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N)
- **Weakness:** CWE-200
- **Usage among sites WPSec scans:** plugin Low, affected versions Low (as of 2026-10-25)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/wp-discussion-board
- **Fix released:** 2026-10-23
- **Published:** 2026-10-24
- **URL:** https://wpsec.com/vuln/WPSEC-2026-1593/

## Description

The Discussion Board plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.6.0 due to viewer role restrictions only being enforced on single topic pages. This makes it possible for unauthenticated attackers to read discussion topics and replies restricted to specific roles through search results, RSS feeds, comment feeds, the Recent Comments widget and the XML sitemap.

## References

- https://wpsec.com/vuln/WPSEC-2026-1593/
- https://plugins.svn.wordpress.org/wp-discussion-board/tags/2.6.1/
- https://wordpress.org/plugins/wp-discussion-board/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-1593/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.