{
 "id": "WPSEC-2026-1668",
 "url": "https://wpsec.com/vuln/WPSEC-2026-1668/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-1668/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-1668/index.md",
 "title": "GD bbPress Attachments <= 4.9.4 - Authenticated (Subscriber+) Missing Authorization to Restricted File Upload",
 "description": "The forumAttachments for bbPress plugin for WordPress is vulnerable to unauthorized file attachment uploads in all versions up to, and including, 4.9.4 due to a missing server-side check in the topic and reply save handlers of whether the user's role is allowed to upload, whether attachments are enabled for the forum, and the maximum number of files. These checks were only applied when rendering the upload form. This makes it possible for authenticated attackers with Subscriber-level access and above to bypass role and per-forum attachment restrictions and upload limits by submitting files directly with a topic or reply.",
 "plugin": {
  "slug": "gd-bbpress-attachments",
  "name": "GD bbPress Attachments",
  "full_name": "forumAttachments for bbPress",
  "wordpress_org": "https://wordpress.org/plugins/gd-bbpress-attachments/",
  "advisories_url": "https://wpsec.com/vuln/plugin/gd-bbpress-attachments/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/gd-bbpress-attachments"
 },
 "type": "UPLOAD",
 "cwe": [
  "CWE-862"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 4.3,
  "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
  "severity": "Medium"
 },
 "affected": {
  "ranges": [
   {
    "from": null,
    "from_inclusive": true,
    "to": "5.0",
    "to_inclusive": false
   }
  ],
  "text": [
   "all versions before 5.0"
  ]
 },
 "introduced_in": null,
 "fixed_in": "5.0",
 "remediation": "Update to 5.0 or later.",
 "fix_released": "2026-10-25T15:21:22+00:00",
 "published": "2026-10-26T16:06:40+00:00",
 "updated": "2026-10-26T09:30:58.259972+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-1668/",
  "https://plugins.svn.wordpress.org/gd-bbpress-attachments/tags/5.0/",
  "https://wordpress.org/plugins/gd-bbpress-attachments/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/gd-bbpress-attachments",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Low",
  "affected_versions": "Low",
  "as_of": "2026-10-27"
 }
}