A flaw in bbPress allows unauthenticated visitors to expose restricted subforum content. The bug occurs because the hide_sitewide filter ignores the visibility of ancestor forums, so topics and replies nested under private or hidden parents are still accessible. The disallowed information—post title, permalink and body—is revealed through the BuddyPress activity stream and the REST endpoint, leading to potential leakage of confidential discussion data.

The issue affects the bbPress WordPress plugin, specifically all releases prior to 2.6.19. Users deploying bbPress 2.6.18 or older with BuddyPress activity streams enabled are at risk.

The CVSS score of 6.3 indicates medium severity. No EPSS score is available, and the vulnerability is not listed in the CISA KEV catalog. The attack vector is inferred to be an unauthenticated, external user accessing the activity stream or REST endpoint without authentication. Because the flaw relies on content visibility logic, an attacker can simply browse the exposed URLs to harvest restricted posts.