# Information Disclosure - Unauthen Leak Private Content

bbPress BuddyPress integration checked only a subforum's own status, so topics under a private parent leaked in full to the public activity stream.

- Payout: not disclosed
- Severity: medium
- Program: WordPress
- Credited: thewindghost
- Disclosed: 2026-10-10
- Write-up quality: 7/10
- Original: https://hackerone.com/reports/4053546
- Library page: https://bugbountylibrary.com/r/h1%3A4053546
- Tags: domain:web impact:data-leak kind:bounty platform:hackerone sev:medium tech:rest tech:wordpress technique:source-review vuln:access-control vuln:info-disclosure

**Target:** WordPress bbPress plugin BuddyPress activity integration (REST activity endpoint)
**Root cause:** In includes/extend/buddypress/activity.php, topic_create/reply_create compute hide_sitewide via bbp_is_forum_public($forum_id, false), passing false so ancestor forum status is not checked; a public subforum under a private parent is treated as public.
**Steps:**
1. Create private/hidden parent forum with a publish-status child subforum (forum_id=6).
2. As a member, POST `bbp_topic_title=Test&bbp_topic_content=Secret&bbp_forum_id=6&action=bbp-new-topic&_wpnonce=$N` to the subforum URL.
3. Confirm direct permalink `/forums/topic/test/` returns 404.
4. GET `https://site/wp-json/buddypress/v1/activity` anonymously and grep for `Secret`; rendered body is disclosed.
**How found:** Code review of the BuddyPress integration: noticed bbp_is_forum_public() called with second argument false in activity.php, meaning ancestor visibility is skipped, then tested a public subforum nested under a private parent.
**Exploitation:** Any member able to post in the public subforum triggers activity creation; the resulting BuddyPress activity item is not marked hide_sitewide, so unauthenticated visitors reading the public activity REST endpoint/feed receive title, forum name, permalink and raw body of content whose own permalink 404s.
**Insight:** When a CMS plugin has a visibility helper with an optional 'check ancestors' flag, grep every call site for the flag being disabled; nested public children of private parents are a recurring leak vector into secondary feeds (activity streams, RSS, search indexes, sitemaps).