---
id: CVE-2026-110762
title: >-
  bbPress before 2.6.19 contains an information disclosure vulnerability that
  allows unauthenticated visitors to view restricted subforum posts because
  hide_sitewide ignores ancestor forum visibility
summary: >-
  bbPress before 2.6.19 contains an information disclosure vulnerability that
  allows unauthenticated visitors to view restricted subforum posts because
  hide_sitewide ignores ancestor forum visibility. Topics and replies in public
  subforums…
severity: low
cvss: 3.7
cvssVector: 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N'
cwe:
  - CWE-863
published: '2026-10-14'
updated: '2026-10-14'
sourceUpdated: '2026-10-14T21:17:36.937'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-110762'
references:
  - url: 'https://bbpress.org/blog/2026/09/bbpress-2-6-19-is-out/'
    label: disclosure@vulncheck.com
  - url: >-
      https://github.com/bbpress/bbPress/blob/04c6f1513c6ca34e849ca16015b7a08b3c15e753/src/includes/extend/buddypress/activity.php#L431
    label: disclosure@vulncheck.com
  - url: >-
      https://github.com/bbpress/bbPress/commit/5dce23a0b23a22d32c45b96fd44588952b16fe8a
    label: disclosure@vulncheck.com
  - url: 'https://wordpress.org/plugins/bbpress/'
    label: disclosure@vulncheck.com
  - url: >-
      https://www.vulncheck.com/advisories/bbpress-before-2.6.19-information-disclosure-via-buddypress-activity-stream
    label: disclosure@vulncheck.com
tags:
  - nvd
  - cve.org
ingestedAt: '2026-10-14T19:49:57.609Z'
vendor: bbPress
product: bbPress
affected:
  - bbPress < 2.6.19
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-10-14T20:23:50.067307Z'
---

## Overview

bbPress before 2.6.19 contains an information disclosure vulnerability that allows unauthenticated visitors to view restricted subforum posts because hide_sitewide ignores ancestor forum visibility. Topics and replies in public subforums nested under private or hidden parents expose title, permalink and body via the BuddyPress activity stream and REST endpoint.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.