# bbPress <= 2.6.20 - Authenticated (Subscriber+) Missing Authorization to BuddyPress Group Forum Posting

- **ID:** WPSEC-2026-1877
- **Plugin:** bbPress (`bbpress`), https://wordpress.org/plugins/bbpress/
- **Affected versions:** all versions before 2.6.21
- **Fixed in:** 2.6.21 (Update to 2.6.21 or later.)
- **Severity:** Medium 4.3 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N)
- **Weakness:** CWE-862
- **Usage among sites WPSec scans:** plugin Medium, affected versions Medium (as of 2026-10-28)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/bbpress
- **Fix released:** 2026-10-27
- **Published:** 2026-10-28
- **URL:** https://wpsec.com/vuln/WPSEC-2026-1877/

## Description

The bbPress plugin for WordPress is vulnerable to unauthorized content creation via the new topic and new reply handlers in all versions up to, and including, 2.6.20, due to group membership and ban checks for BuddyPress group forums being enforced only when displaying the posting forms and when the request runs in the group's context, not in the new topic and new reply handlers. This makes it possible for authenticated attackers with Subscriber-level access and above who are not members of a group, or who have been banned from it, to create topics and replies in that group's forum when the BuddyPress groups integration is in use.

## References

- https://wpsec.com/vuln/WPSEC-2026-1877/
- https://plugins.svn.wordpress.org/bbpress/tags/2.6.21/
- https://wordpress.org/plugins/bbpress/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-1877/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.