Bbpress
Monthly
Missing authorization in the bbPress WordPress forum plugin (versions through 2.6.14) allows unauthenticated remote users to bypass access control restrictions and perform actions gated behind specific forum capability checks without proper authorization. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms the attack requires no authentication and no user interaction against a standard installation. No public exploit or CISA KEV listing exists at time of analysis, but the zero-prerequisite attack conditions make this accessible to opportunistic, automated targeting of WordPress sites running the affected plugin.
An unauthenticated privilege-escalation issue exists in the bbPress plugin before 2.6.5 for WordPress when New User Registration is enabled. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
The bbPress plugin through 2.6.4 for WordPress has stored XSS in the Forum creation section, resulting in JavaScript execution at wp-admin/edit.php?post_type=forum (aka the Forum listing page) for. Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
Missing authorization in the bbPress WordPress forum plugin (versions through 2.6.14) allows unauthenticated remote users to bypass access control restrictions and perform actions gated behind specific forum capability checks without proper authorization. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms the attack requires no authentication and no user interaction against a standard installation. No public exploit or CISA KEV listing exists at time of analysis, but the zero-prerequisite attack conditions make this accessible to opportunistic, automated targeting of WordPress sites running the affected plugin.
An unauthenticated privilege-escalation issue exists in the bbPress plugin before 2.6.5 for WordPress when New User Registration is enabled. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
The bbPress plugin through 2.6.4 for WordPress has stored XSS in the Forum creation section, resulting in JavaScript execution at wp-admin/edit.php?post_type=forum (aka the Forum listing page) for. Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.