# Unauthenticated disclosure of private and hidden forum content in bbPress via the WordPress core REST single-item endpoint

bbPress 2.7.0 registers forum/topic/reply post types with show_in_rest, letting unauthenticated users read private/hidden forum topics and replies via the core REST single-item endpoint by ID.

- Payout: not disclosed
- Severity: critical
- Program: WordPress
- Credited: winstoncrooker
- Disclosed: 2026-10-12
- Write-up quality: 8/10
- Original: https://hackerone.com/reports/3801107
- Library page: https://bugbountylibrary.com/r/h1%3A3801107
- Tags: domain:oss domain:web impact:data-leak kind:bounty platform:hackerone sev:critical tech:rest tech:wordpress technique:incomplete-fix technique:source-review vuln:access-control vuln:info-disclosure

**Target:** WordPress core REST API single-item endpoint (/wp-json/wp/v2/topic|reply|forum)
**Root cause:** Topics/replies in private or hidden forums are stored with post_status=publish; bbPress enforces forum visibility only via a pre_get_posts filter, which the core REST single-item endpoint bypasses because get_item() uses get_post() directly and check_read_permission() allows any publish-status post.
**Steps:**
1. Install WordPress with bbPress 2.7.0 trunk and pretty permalinks.
2. Create a hidden or private forum and post a topic and reply in it (stored as publish).
3. Unauthenticated: `GET /wp-json/wp/v2/topic/<id>` and `GET /wp-json/wp/v2/reply/<id>` return HTTP 200 with full `content.rendered`.
4. Confirm controls: `GET /wp-json/wp/v2/topic` excludes it, front-end permalink 404, `GET /wp-json/wp/v2/forum/<id>` returns 401 rest_forbidden.
5. Iterate sequential topic/reply IDs to harvest the restricted corpus.
**How found:** Automated source-analysis pass reviewed bbPress read paths for ones bypassing forum-visibility enforcement; spotted show_in_rest=>true added for Gutenberg support and reasoned that the core REST single-item get_post() lookup skips the pre_get_posts visibility filter, then verified against a live instance with control checks.
**Exploitation:** No auth or interaction needed; attacker enumerates sequential post IDs against the core REST single-item routes and reads full content of members-only topics/replies, scaling to the entire private/hidden forum corpus.
**Insight:** When a plugin enforces access only through pre_get_posts/WP_Query filters, any code path using get_post() by ID (core REST single-item, feeds, oEmbed, XML-RPC) bypasses it; check show_in_rest and check_read_permission for publish-status children of restricted containers.