[5ngua]

Suppose now we allow guest users without accounts to create topics and replies (anonymous posting)

Suppose that my forum has a member “John” registered with email address: john@site.com

Now if an Anonymous fill john@site.com as the email address when posting, the post will show up with the post Author as John (but in fact it is not John)

I find this is a bug not only in bbPress but also in WordPress comment.

Hope that will be resolved in the next release.

[John James Jacoby]

Not a bug, though it’s something you may wish to be concerned about in your own site. Anonymous posting is just that, so this is by design.

[5ngua]

yeah, maybe not a bug, but please imagine about this…Suppose John is the Key Master of the Forum and he is a very important person who makes every announcement of the community. One day a Anonymous guy guesses John’s email address at the Forum and makes an anonymous announcement with John’s email address saying that the forum is going to be closed. Oh…you know this is an inconvenience

[5ngua]

I would suggest that when the registered email is filled to anonymous post, it has to show up a message or a requirement for logging in to continuous posting.

[hamzahali]

I agree, i faced this problem on one of my sites. I died trying to find out how he hacked, then got to know of this loophole.