GD bbPress Attachments <= 4.9.4 - Authenticated (Subscriber+) Missing Authorization to Restricted File Upload
- ID
- WPSEC-2026-1668
- Plugin
- forumAttachments for bbPress (gd-bbpress-attachments)
- Affected
- all versions before 5.0
- Remediation
- Update to 5.0 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
- Weakness
- CWE-862
- Usage
- Plugin Low · Affected versions Low among sites WPSec scans, 2026-10-27
- Attack surface
- GD bbPress Attachments on WPSec AttackSurface
- Fix released
- Published
Description
The forumAttachments for bbPress plugin for WordPress is vulnerable to unauthorized file attachment uploads in all versions up to, and including, 4.9.4 due to a missing server-side check in the topic and reply save handlers of whether the user's role is allowed to upload, whether attachments are enabled for the forum, and the maximum number of files. These checks were only applied when rendering the upload form. This makes it possible for authenticated attackers with Subscriber-level access and above to bypass role and per-forum attachment restrictions and upload limits by submitting files directly with a topic or reply.
References
- https://wpsec.com/vuln/WPSEC-2026-1668/
- https://plugins.svn.wordpress.org/gd-bbpress-attachments/tags/5.0/
- https://wordpress.org/plugins/gd-bbpress-attachments/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS