Install
bbp style pack
once activated go to
dashboard>settings>bbp style pack>Topic/Reply Display
and items 17, 18 & 19 will let you set what you want
Is someone working a patch or fix?
Wordfence gives alerts to this issue.
patchstack, credited with finding this CVE:
States “This security issue has a low severity impact and is unlikely to be exploited.” and has no vPatch. Here is that report.
bbPress <= 2.6.14 – Missing Authorization
Wordfence Intelligence > Vulnerability Database > bbPress <= 2.6.14 – Missing Authorization
5.3
Missing Authorization
CVSS VectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
CVE CVE-2026-74010
CVSS 5.3 (Medium)
Publicly Published August 31, 2026
Last Updated September 1, 2026
Researcher Ananda Dhakal
Description
The bbPress plugin for WordPress is vulnerable to unauthorized access in all versions up to, and including, 2.6.14. This is due to a missing capability check on a function. This makes it possible for unauthenticated attackers to perform an unauthorized action.
References
vdp.patchstack.com
Thanks for sharing this fix. While working on Instatroids, we’ve also encountered similar WordPress embed issues caused by plugin conflicts. This solution is simple and helpful.
You can use shortcodes instead
Shortcodes
There are also additional ones with filters in
bbp style pack
once activated go to
dashboard>settings>bbp style pack>shortcodes
FILE: /bbpress/includes/common/formatting.php
---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------
FOUND 0 ERRORS AND 2 WARNINGS AFFECTING 2 LINES
---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------
810 | WARNING | seems_utf8() has been deprecated since WordPress version 6.9.0. Use wp_is_valid_utf8() instead. (WordPress.WP.DeprecatedFunctions.seems_utf8Found)
811 | WARNING | Function utf8_encode() is deprecated since PHP 8.2; Use mb_convert_encoding(), UConverter::transcode() or iconv instead (PHPCompatibility.FunctionUse.RemovedFunctions.utf8_encodeDeprecated)
---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------
FILE: /bbpress/includes/admin/tools/repair.php
-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------
FOUND 1 ERROR AFFECTING 1 LINE
-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------
372 | ERROR | The parameter "array( 'hide_empty' => false )" at position #2 of get_terms() has been deprecated since WordPress version 4.5.0. Instead do not pass the parameter. (WordPress.WP.DeprecatedParameters.Get_termsParam2Found)
-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------
FILE: /bbpress/includes/common/functions.php
-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------
FOUND 1 ERROR AFFECTING 1 LINE
-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------
532 | ERROR | The parameter "array( 'hide_empty' => true )" at position #2 of wp_count_terms() has been deprecated since WordPress version 5.6.0. Instead do not pass the parameter.
| | (WordPress.WP.DeprecatedParameters.Wp_count_termsParam2Found)
-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------
PHP 8.5
WP 7.0.1
bbpress 2.6.14
Thanks for that really useful and detailed post.
My working theory would be that turnkey bbpress is adding something to the header – if another theme shows it as a lock, then that is the most likely, but I may well be incorrect !
Are you using the version on wordpress? https://wordpress.org/plugins/weaver-for-bbpress/
or where did you get it from?
It might be worth you posting the issue on
Turnkey bbPress by WeaverTheme
to see if they can help.
I am not a bbpress author, just a volunteer who tries to help here, but please do come back and I’ll see if I can help further
Thank you so much for your post and the suggestions.
Using the suggestions I have determined that this problem doesn’t occur if I use one of these options. All of the options don’t have to be used, just picking one gets rid of the issue.
1) Don’t use the closed threads option at all.
2) Deactivate the plugin Turnkey bbPress by WeaverTheme
3) Change the theme. The lock shows normally without the code being there.
But this doesn’t really solve it because I want to keep the theme and the plugin.
I assumed that there is an issue with the way the dashicons were being processed.
I added this to functions.php. It did not change anything.
I feel like perhaps there is an issue with the title formatting.
If I go to the post and click on Edit Topic, it doesn’t show any extra code in the title section. Yet I see that this <span> is being inserted into the title of the forum post (as shown above) and I think WordPress may be stripping out the code which is why it shows. I could be wrong in this, but where would I look to see how to change this.
not one I’ve seen before, it could be a theme or plugin issue
Themes
As a test switch to a default theme such as twentytwenty, and see if this fixes.
Plugins
If that doesn’t work, also deactivate all plugins apart from bbpress and see if this fixes. if it does, re-enable one at a time to see which is causing the error.
If you cannot do this to your site (say because it is live) then use the ‘troubleshooting’ features of this plugin to let you test without affecting other users
Health Check & Troubleshooting
Then come back
If I close a topic, it’s nice that it shows a lock icon in the link, but when one clicks on the thread, it shows the code at the top of the page.
How do I remove this code from the title while still keeping the threads locked?
Thank you.
Wordpress 7.0
BBPress Version 2.6.14
On the bbPress forum “Create New Topic” page, when the Visual editor tab is active, the TinyMCE toolbar controls (Bold, Italic, Lists, Link, Image, etc.) cannot be accessed using the Tab key.
Keyboard users are unable to navigate to or interact with the formatting toolbar, which prevents them from using editor formatting features without a mouse.
Steps to Reproduce
Navigate to a bbPress forum page.
Select Create New Topic.
Ensure the Visual editor tab is active.
Place focus in the editor area.
Press the Tab key to navigate through available controls.
Actual Result
Focus skips the TinyMCE toolbar controls.
Toolbar buttons cannot be reached or activated using keyboard navigation.
Users must use a mouse to access formatting options.
Expected Result
All toolbar controls should be reachable via keyboard navigation.
Focus order should move through each toolbar button in a logical sequence.
Users should be able to activate toolbar functions using keyboard controls (Enter/Space).
Accessibility Impact
Affects keyboard-only users.
Affects screen reader users who rely on keyboard navigation.
Prevents equal access to content authoring functionality.
WCAG Success Criteria
2.1.1 Keyboard (Level A)
2.1.2 No Keyboard Trap (Level A) (verify during testing)
2.4.3 Focus Order (Level A)
4.1.2 Name, Role, Value (Level A) (if toolbar controls lack proper accessibility attributes)
Environment
Platform: WordPress + bbPress
Component: TinyMCE Visual Editor (Create New Topic form)
Browser(s): Chrome, Edge
Assistive Technology: NVDA (if tested)
Screenshot Reference
https://prnt.sc/PJVhxYwNyVvf
Thanks a bunch for taking the time to detail all that.
About translations I am trying to contribute to the official community translations for the plugin in French. I found the culprit strings and added translations for them. https://translate.wordpress.org/projects/wp-plugins/bbp-style-pack/stable/fr/default/?filters%5Bterm%5D=Moderation+Flag&filters%5Bterm_scope%5D=scope_any&filters%5Bstatus%5D=current_or_waiting_or_fuzzy_or_untranslated&filters%5Buser_login%5D=&filter=Apply+Filters&sort%5Bby%5D=priority&sort%5Bhow%5D=desc
Then of course it will only merge when 90+% is translated (and validated), is that correct?
I struggled to find it in the codebase at first because I thought it was in bbpress, my bad. It was then helpful to use the translation website. For further reference it was at the time of writing at modtools/bbpress.php#L215 (in bbp style pack plugin of course)
The most frustrating thing with plugins like bbpress/Buddypress ecosystem is undocumented features/hooks and config parameters and the difficulty it puts on users wanting to work with it or even contribute to understand everything and how each piece comes together with the rest of wordpress in a 15 year old codebase… but thanks to people like you we can go further is making those better 👍
Thanks again for the quick answers
I’ve got it to work now.
I used the WordPress function wp_delete_post.
Presuming that you want to delete the user and any comments made in wordpress as well, then
dashboard>users>select the user and press delete
You will then be given the option to delete all content and the user.
Install this additional plugin
Private groups
This is a simple plugin in principle, but can take a bit of time to understand.
So FIRST in dashboard>settings>bbp private groups> select the help tab, and take some time to understand how this plugin works !!
Then…
1. go to dashboard>settings>bbp private groups> and select ‘group name settings’ – set group 1 to a name of your choice, say ‘topics only’
2. go to dashboard>settings>bbp private groups> and select ‘topic settings’ – click to activate topic settings and save.
3. go to dashboard>settings>bbp private groups> and select ‘assign groups to roles’ – tick ‘Add group on first or no-group login’ AND set the role ‘subscriber’ to the group 1 name you set in step 1. If you want other roles to only be able to post topics, set these as well. click save.
4. go to dashboard>forums and select the forum you want this to apply to and click ‘edit’ You will see a new box called ‘Forum groups’ Click group 1 and them click update on the right hand side.
5. You will then see topic permissions for this group. select ‘Create/edit topics’
So then the forum uses group 1 permissions which only allow the creation of topics, and subscriber users are in group 1, so that is all they are able to do.
You may need to adjust forum visibility in the plugin settings and non logged-in isers depending on how you forum works.
Hello, I am a veteran WordPress user and old SEO guy, recently turned into a vibe coder. I built a WP plugin that can read BBpress forums, topics and replies, and answer visitors’ questions using AI. It can summarize several informations, and give a summarized answers with a link to the source. The goal is to retain visitors that might feel lost in the large amount of info, and to help finding relevant content right on their arrival in the forum. What do you think, can it be helpfull ?
I’m actually looking into this as well 👀
I’m planning to convert my existing WordPress site into a full forum using bbPress, and the classic/default theme setup is something I’m trying to understand better.
From what I’ve gathered so far, it seems like the process is:
* install and activate bbPress plugin
* create forums from the dashboard
* then adjust the theme (or use a child theme) to make it look more like a proper forum
I’m still a bit unsure about the best way to properly switch or enforce the “classic” bbPress layout across the site.
Would love to hear how you approached it — especially if you managed to fully convert your site into a forum-style experience rather than just adding forums as a section.
Thanks! 👍
I suspect you are using a block theme also known as “Full Site Editing” or FSE theme
This is one of the “block themes” – this is the new way that WordPress plans to develop themes. BBpress authors are working on a fix for this, but in the meantime, add this additional plugin
Enable bbPress for Block Themes
Come back if this does not work
https://vitaemagazineblog.com/forums/forum/family-tree/
wordpress.com couldn’t resolve my problem and they shorn me over to the bbpress.org website to handle the problem … i want to do a bbPress forum on that website but i can’t get it started and wordpress doesn’t know why we tried a different theme and that didn’t work … i uninstalled all the plugins and that didn’t help … i checked the root directory and made a change to it and broke it and changed it back and got back to square one so i think the root directory is fine … i couldn’t and can’t reset the permalinks because i’m not at that level yet on wordpress … this occurred directly after installation and i created a forum and it went to the white screen when i checked the permalink and then i started a topic and that permalink went to the white screen … i’m just a writer this is already too much code for me to handle
so if anyone knows anything about this let me know …
Add this additional plugin
Private groups
once activated, go to dashboard>settings>bbp private groups>help tab and read through how to set this up.
1. so for instance if you wanted ‘editors‘ to have their own private forum, then in
2. dashboard>settings>bbp private groups>group name settings and set up group 1 with a name ‘say editors-private-forum’. but could be whatever you want.
3. then in
dashboard>forums – create a forum, or edit an existing forum, and then under the description you will see a section headed ‘Forum Groups’ – assign this forum to the group you set above
so this forum is now only accessible to users who have that private group assigned.
4. then in
dashboard>settings>bbp private groups>assign groups to roles
set the editors role (or whatever role you want to access the forum that you set up in step 1) to the group.
and that should set editors to be able to see and access that forum only
All other forums remain as they were.
some great fault finding carried out there, many thanks for that.
To start at the end, twenty twenty five is a FSE theme and pending the next release of bbpress you need to add
wordpress.org/plugins/enable-bbp-block-theme/
It looks like you have an issue between Highend Theme 1.0.2 and buddypress, which might be difficult to get resolved.
As highend is a paid theme, I cannot check it out, but I would start by asking them, as you can show it working with a wordpress default theme, but not with highend#
Hi,
WP-optimize suggets BBPress could be concerned.
So I change page with BBPress shortcode into a comment and I’ve desactivated BBPress. Today at same time I can read this in php-errors.log:
[28-Feb-2026 13:08:58 UTC] PHP Deprecated: La fonction seems_utf8 est obsolète depuis la version 6.9.0 ! Utilisez wp_is_valid_utf8() à la place. in /xxx/wordpress/wp-includes/functions.php on line 6131
[28-Feb-2026 13:09:50 UTC] PHP Warning: Undefined array key “edit-page” in /xxx/wordpress/wp-content/plugins/ionos-essentials/ionos-essentials/inc/dashboard/blocks/next-best-actions/class-nba.php on line 110
[28-Feb-2026 15:46:51 UTC] PHP Notice: Function is_search was called incorrectly. Conditional query tags do not work before the query is run. Before then, they always return false. Please see Debugging in WordPress for more information. (This message was added in version 3.1.0.) in /xxx/wordpress/wp-includes/functions.php on line 6131
[28-Feb-2026 15:46:51 UTC] PHP Notice: Function is_404 was called incorrectly. Conditional query tags do not work before the query is run. Before then, they always return false. Please see Debugging in WordPress for more information. (This message was added in version 3.1.0.) in /homepages/22/d4298730425/htdocs/wordpress/wp-includes/functions.php on line 6131
[28-Feb-2026 15:46:51 UTC] PHP Notice: Function is_feed was called incorrectly. Conditional query tags do not work before the query is run. Before then, they always return false. Please see Debugging in WordPress for more information. (This message was added in version 3.1.0.) in /homepages/22/d4298730425/htdocs/wordpress/wp-includes/functions.php on line 6131
[28-Feb-2026 15:46:51 UTC] Erreur d’événement de déplanification de tâche pour le crochet extendify_fetch_partner_data. Code d’erreur : could_not_set. Message d’erreur : La liste des évènements planifiés n’a pas pu être sauvegardée.. Données : {“schedule”:false,”args”:[]}
No fatal error with BBPress desactivated.
A surprise with cron task extendify not listed in cron task.
The only paused one is userfeedback_usage_tracking_cron, but no userfeedback plugin install, maybe linked jetpack (desinstalled) or MonsterInsights.
Or linked with Ionos Hosting as he is mentionned in first warning with Ionos-essentials.
