{
 "id": "WPSEC-2026-1877",
 "url": "https://wpsec.com/vuln/WPSEC-2026-1877/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-1877/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-1877/index.md",
 "title": "bbPress <= 2.6.20 - Authenticated (Subscriber+) Missing Authorization to BuddyPress Group Forum Posting",
 "description": "The bbPress plugin for WordPress is vulnerable to unauthorized content creation via the new topic and new reply handlers in all versions up to, and including, 2.6.20, due to group membership and ban checks for BuddyPress group forums being enforced only when displaying the posting forms and when the request runs in the group's context, not in the new topic and new reply handlers. This makes it possible for authenticated attackers with Subscriber-level access and above who are not members of a group, or who have been banned from it, to create topics and replies in that group's forum when the BuddyPress groups integration is in use.",
 "plugin": {
  "slug": "bbpress",
  "name": "bbPress",
  "full_name": "bbPress",
  "wordpress_org": "https://wordpress.org/plugins/bbpress/",
  "advisories_url": "https://wpsec.com/vuln/plugin/bbpress/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/bbpress"
 },
 "type": "NO AUTHORISATION",
 "cwe": [
  "CWE-862"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 4.3,
  "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
  "severity": "Medium"
 },
 "affected": {
  "ranges": [
   {
    "from": null,
    "from_inclusive": true,
    "to": "2.6.21",
    "to_inclusive": false
   }
  ],
  "text": [
   "all versions before 2.6.21"
  ]
 },
 "introduced_in": null,
 "fixed_in": "2.6.21",
 "remediation": "Update to 2.6.21 or later.",
 "fix_released": "2026-10-27T21:23:56+00:00",
 "published": "2026-10-28T21:42:51+00:00",
 "updated": "2026-10-28T09:33:33.578514+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-1877/",
  "https://plugins.svn.wordpress.org/bbpress/tags/2.6.21/",
  "https://wordpress.org/plugins/bbpress/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/bbpress",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Medium",
  "affected_versions": "Medium",
  "as_of": "2026-10-28"
 }
}