{"id":"CVE-2026-110762","title":"bbPress before 2.6.19 contains an information disclosure vulnerability that allows unauthenticated visitors to view restricted subforum posts because hide_sitewide ignores ancestor forum visibility","summary":"bbPress before 2.6.19 contains an information disclosure vulnerability that allows unauthenticated visitors to view restricted subforum posts because hide_sitewide ignores ancestor forum visibility. Topics and replies in public subforums…","severity":"low","cvss":3.7,"cvssVector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N","cwe":["CWE-863"],"published":"2026-10-14","updated":"2026-10-14","sourceUpdated":"2026-10-14T21:17:36.937","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-110762","references":[{"url":"https://bbpress.org/blog/2026/09/bbpress-2-6-19-is-out/","label":"disclosure@vulncheck.com"},{"url":"https://github.com/bbpress/bbPress/blob/04c6f1513c6ca34e849ca16015b7a08b3c15e753/src/includes/extend/buddypress/activity.php#L431","label":"disclosure@vulncheck.com"},{"url":"https://github.com/bbpress/bbPress/commit/5dce23a0b23a22d32c45b96fd44588952b16fe8a","label":"disclosure@vulncheck.com"},{"url":"https://wordpress.org/plugins/bbpress/","label":"disclosure@vulncheck.com"},{"url":"https://www.vulncheck.com/advisories/bbpress-before-2.6.19-information-disclosure-via-buddypress-activity-stream","label":"disclosure@vulncheck.com"}],"tags":["nvd","cve.org"],"ingestedAt":"2026-10-14T19:49:57.609Z","vendor":"bbPress","product":"bbPress","affected":["bbPress < 2.6.19"],"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"partial","timestamp":"2026-10-14T20:23:50.067307Z"},"slug":"CVE-2026-110762","body":"## Overview\n\nbbPress before 2.6.19 contains an information disclosure vulnerability that allows unauthenticated visitors to view restricted subforum posts because hide_sitewide ignores ancestor forum visibility. Topics and replies in public subforums nested under private or hidden parents expose title, permalink and body via the BuddyPress activity stream and REST endpoint.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":20,"depthScoreParts":{"impact":20.4,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}