Low severity · published Oct 14, 2026
CVE-2026-110762
bbPress before 2.6.19 Information Disclosure via BuddyPress Activity Stream
3.7
CVSS
0.2%
EPSS
No
On KEV
Description
bbPress before 2.6.19 contains an information disclosure vulnerability that allows unauthenticated visitors to view restricted subforum posts because hide_sitewide ignores ancestor forum visibility. Topics and replies in public subforums nested under private or hidden parents expose title, permalink and body via the BuddyPress activity stream and REST endpoint.
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
Attack vector
Network
Complexity
High
Privileges
None
User interaction
None
Confidentiality
Low
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 13% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
BB
bbPress · bbPress
before 2.6.19 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-110762
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-110762
bbpress.org
https://bbpress.org/blog/2026/09/bbpress-2-6-19-is-out/
github.com
https://github.com/bbpress/bbPress/blob/04c6f1513c6ca34e849ca16015b7a08b3c15e753/src/includes/extend/buddypress/activity.php#L431
github.com
https://github.com/bbpress/bbPress/commit/5dce23a0b23a22d32c45b96fd44588952b16fe8a
wordpress.org
https://wordpress.org/plugins/bbpress/
www.vulncheck.com
https://www.vulncheck.com/advisories/bbpress-before-2.6.19-information-disclosure-via-buddypress-activity-stream
More from bbPress
9.8
CVE-2020-13693
An unauthenticated privilege-escalation issue exists in the bbPress plugin before 2.6.5 for WordPress when New User Registration is enabled
6.1
CVE-2011-1150
bbPress through 1.0.2 has XSS in /bb-login.php url via the re parameter
4.8
CVE-2020-13487
The bbPress plugin through 2.6.4 for WordPress has stored XSS in the Forum creation section, resulting in JavaScript execution at wp-admin/edit.php?post_type=forum (aka the Forum…
–
CVE-2011-3710
bbPress 1.0.2 allows remote attackers to obtain sensitive information via a direct request to a .php file, which reveals the installation path in an error message, as demonstrated…
–
CVE-2007-3243
Cross-site scripting (XSS) vulnerability in bb-login.php in bbPress 0.8.1 allows remote attackers to inject arbitrary web script or HTML via the re parameter