# GD bbPress Attachments <= 4.9.4 - Authenticated (Subscriber+) Missing Authorization to Restricted File Upload

- **ID:** WPSEC-2026-1668
- **Plugin:** forumAttachments for bbPress (`gd-bbpress-attachments`), https://wordpress.org/plugins/gd-bbpress-attachments/
- **Affected versions:** all versions before 5.0
- **Fixed in:** 5.0 (Update to 5.0 or later.)
- **Severity:** Medium 4.3 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N)
- **Weakness:** CWE-862
- **Usage among sites WPSec scans:** plugin Low, affected versions Low (as of 2026-10-27)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/gd-bbpress-attachments
- **Fix released:** 2026-10-25
- **Published:** 2026-10-26
- **URL:** https://wpsec.com/vuln/WPSEC-2026-1668/

## Description

The forumAttachments for bbPress plugin for WordPress is vulnerable to unauthorized file attachment uploads in all versions up to, and including, 4.9.4 due to a missing server-side check in the topic and reply save handlers of whether the user's role is allowed to upload, whether attachments are enabled for the forum, and the maximum number of files. These checks were only applied when rendering the upload form. This makes it possible for authenticated attackers with Subscriber-level access and above to bypass role and per-forum attachment restrictions and upload limits by submitting files directly with a topic or reply.

## References

- https://wpsec.com/vuln/WPSEC-2026-1668/
- https://plugins.svn.wordpress.org/gd-bbpress-attachments/tags/5.0/
- https://wordpress.org/plugins/gd-bbpress-attachments/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-1668/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.