bbPress CVE-2026-110762

Exploitation requires BuddyPress to be active alongside bbPress with its sitewide activity stream and/or activity REST endpoint reachable, AND an administrator-created forum topology where public subforums are nested under a private or hidden parent forum - the stored hide_sitewide flag is set on public children while the restricting ancestor visibility is ignored. Limiting factors: this nesting arrangement is not the default, sites without BuddyPress are unaffected, and only content already posted to the affected subforums (titles, permalinks, bodies) is exposed - no integrity or availability impact. These configuration requirements (reflected as AT:P in the 4.0 vector) meaningfully reduce the population of exploitable installations below the raw bbPress install base.

This is a genuine but moderate-priority issue, best characterized as a real low-impact authorization/information-disclosure flaw rather than a high-urgency threat. The vendor-supplied CVSS 4.0 vector (AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/...) scores 6.3 (Medium) and consistently describes a network-reachable, unauthenticated flaw with only LOW confidentiality impact and no integrity or availability impact - matching the description, which limits exposure to the title, permalink, and body of posts in restricted subforums. The key tempering signal is AT:P (an attack requirement is present): exploitation depends on a specific non-default forum topology (public subforums nested under private/hidden parents) and on BuddyPress being active with its activity stream/REST endpoint exposed, so this is not a blanket default-config exposure. No EPSS score, no CISA KEV listing, and no public exploit code are present in the input, so there is no evidence of active or widespread exploitation; the only external research signal is a VulnCheck advisory (an advisory, not a POC). Signals are internally consistent - there is no CVSS-vs-description conflict here - which supports treating this as a patch-in-normal-cycle item for affected BuddyPress+bbPress deployments rather than an emergency.

An unauthenticated visitor browses or queries a bbPress site that runs BuddyPress, where an administrator has placed public subforums beneath a private or hidden parent forum. By reading the BuddyPress sitewide activity stream or hitting the activity REST endpoint, the attacker retrieves titles, permalinks, and body text of topics and replies that were intended to be restricted, because hide_sitewide never re-checks the ancestor forum's visibility. No public exploit code is identified at time of analysis, but the attack is trivial once the vulnerable configuration exists.