EUVD-2026-76200
GHSA-365v-89rm-vvfv
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Network-reachable endpoint with no auth or user interaction required; only partial confidentiality loss, no integrity or availability impact.
Primary rating from Vendor (Patchstack).
CVSS VectorVendor: Patchstack
Lifecycle Timeline
3DescriptionCVE.org
Unauthenticated Sensitive Data Exposure in bbPress <= 2.6.14 versions.
AnalysisAI
Sensitive data exposure in bbPress WordPress forum plugin 2.6.14 and earlier allows unauthenticated remote attackers to access restricted information due to missing authorization checks (CWE-862). The CVSS vector confirms network-accessible, no-authentication-required exploitation with a low confidentiality impact, consistent with unauthorized read access to content that should be gated. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires only network access to a WordPress installation running bbPress 2.6.14 or earlier - no authentication, no user interaction, and no special client configuration. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | CVSS 5.3 with AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N is an honest representation of a low-complexity, network-reachable, unauthenticated read-only disclosure. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Update bbPress to the version immediately above 2.6.14 per the Patchstack advisory; the exact patched release version is not independently confirmed in the available reference data, so administrators should verify the latest stable release in the WordPress plugin repository (wordpress.org/plugins/bbpress/) and apply it promptly. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
An unauthenticated privilege-escalation issue exists in the bbPress plugin before 2.6.5 for WordPress when New User Regi
The bbPress plugin through 2.6.4 for WordPress has stored XSS in the Forum creation section, resulting in JavaScript exe
Missing authorization in the bbPress WordPress forum plugin (versions through 2.6.14) allows unauthenticated remote user
Same weakness CWE-862 – Missing Authorization
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today