EUVD-2026-68504
GHSA-5f39-f66q-w7v7
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Network-reachable with no authentication (PR:N) per the missing authorization root cause; integrity-only low impact reflects restricted forum action scope with no confidentiality or availability consequence.
Primary rating from Vendor (Patchstack).
CVSS VectorVendor: Patchstack
Lifecycle Timeline
1DescriptionCVE.org
Missing Authorization vulnerability in John James Jacoby bbPress allows Exploiting Incorrectly Configured Access Control Security Levels.
This issue affects bbPress: from n/a through 2.6.14.
AnalysisAI
Missing authorization in the bbPress WordPress forum plugin (versions through 2.6.14) allows unauthenticated remote users to bypass access control restrictions and perform actions gated behind specific forum capability checks without proper authorization. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms the attack requires no authentication and no user interaction against a standard installation. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The bbPress plugin version 2.6.14 or earlier must be installed and active on a WordPress site accessible over the network. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 5.3 Medium score is shaped primarily by the low integrity impact ceiling (I:L) and unchanged scope (S:U), which cap the rating despite favorable attacker conditions: network reachable, low complexity, no privileges, no interaction. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Update bbPress to a version beyond 2.6.14 from the WordPress plugin repository (Dashboard → Plugins → Update). … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
An unauthenticated privilege-escalation issue exists in the bbPress plugin before 2.6.5 for WordPress when New User Regi
The bbPress plugin through 2.6.4 for WordPress has stored XSS in the Forum creation section, resulting in JavaScript exe
Same weakness CWE-862 – Missing Authorization
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today