🎯 New Report #3801107: Unauthenticated disclosure of private and hidden forum content in bbPress via the WordPress core REST single-item endpoint
🔺Severity: Critical
👽 Reporter: winstoncrooker
⭐️ Reputation: 292
🛠 State: resolved
💼 Team: WordPress
💵 Bounty: null
🕐 Submitted: 2026-06-14
⏰ Disclosed: 2026-10-12 06:53:02
📝 Summary: A forum plugin version 2.7.0 registered post types with REST API exposure without enforcing the same access restrictions applied on other platforms. Private and hidden forum topics and replies were stored with public status, and forum visibility was only enforced through query filters that were bypassed by direct REST API single-item requests. Unauthenticated attackers could retrieve the full content of restricted forum posts by making direct REST API calls with sequential post identifiers. The vulnerability was not present in the previous release line, which did not expose these post types to the REST API.
📂 Report JSON File: 3801107
@hackeronereports