bbPress <= 2.6.20 - Authenticated (Subscriber+) Missing Authorization to BuddyPress Group Forum Posting
- ID
- WPSEC-2026-1877
- Plugin
- bbPress (bbpress)
- Affected
- all versions before 2.6.21
- Remediation
- Update to 2.6.21 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
- Weakness
- CWE-862
- Usage
- Plugin Medium · Affected versions Medium among sites WPSec scans, 2026-10-28
- Attack surface
- bbPress on WPSec AttackSurface
- Fix released
- Published
Description
The bbPress plugin for WordPress is vulnerable to unauthorized content creation via the new topic and new reply handlers in all versions up to, and including, 2.6.20, due to group membership and ban checks for BuddyPress group forums being enforced only when displaying the posting forms and when the request runs in the group's context, not in the new topic and new reply handlers. This makes it possible for authenticated attackers with Subscriber-level access and above who are not members of a group, or who have been banned from it, to create topics and replies in that group's forum when the BuddyPress groups integration is in use.
References
- https://wpsec.com/vuln/WPSEC-2026-1877/
- https://plugins.svn.wordpress.org/bbpress/tags/2.6.21/
- https://wordpress.org/plugins/bbpress/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS