This release strengthens topic and reply password validation and keeps bbPress post shortcodes literal in ordinary WordPress content loops. It also adds a site-wide Forum Status setting with Open, Closed, and Frozen modes. Existing sites remain Open unless that setting is changed.

The maintenance work improves BuddyPress profile actions, group topic routes, activity visibility, and group-forum access. It also restores compatibility for subscription links in third-party theme packages, preserves moderation forms after validation errors, and includes fixes for notifications, converters, widgets, profiles, topic and reply administration, and restricted-content visibility.

bbPress 2.6.20 still requires WordPress 6.0 or newer and PHP 7.2 or newer, and is tested through WordPress 7.1. The database version remains 264, so no database upgrade is required. The 2.6.20 upgrade notes cover compatibility details.

These changes are also in the 2.7 development branch, which remains 2.7.0-alpha-4. Thank you to ahillmortons, alejandroescobar89, bor0, bradleyt, chefranov, dd32, deborah86, Dermes, diegootgs, dilip2615, fraph24, hardel, imath, immeet94, iworks, jgasba, josephscott, konnektiv, lmstearn, mehrazmorshed, michael8888, mike80222, obenland, Palagrin, peopleinside, r-a-y, robin-w, SirLouen, tobifjellner, wpturk, and zaerl for reports, patches, testing, and review.

Download bbPress 2.6.20 from WordPress.org, or update from your WordPress dashboard.

This release applies inherited forum passwords to REST API responses and BuddyPress activity, and strengthens access checks for restricted forum content across feeds, group forums, and other indirect views. It also tightens moderation and forum-role permissions, protects importer credentials and account handling, and improves escaping in profile and administration output.

There are maintenance fixes for BuddyPress group-forum associations and notifications, converter cleanup, imported database passwords, subscription emails, and reply positioning. The 2.6.19 upgrade notes cover integration details. bbPress still requires WordPress 6.0 or newer and PHP 7.2 or newer. The automatic database version 264 upgrade clears saved converter query SQL from older password upgrades.

These changes are also in the 2.7 development branch, which is now 2.7.0-alpha-4. Thank you to thewindghost, ngonhuy, and moltenbit for responsibly reporting issues fixed in this release, and to everyone who helped review and test the changes.

Download bbPress 2.6.19 from WordPress.org, or update from your WordPress dashboard.

Imported users can now upgrade their passwords on first login for more legacy forum formats, including cases where the original forum database is no longer available. This release also corrects PHPWind topic statuses, reply counts, and forum dates during import, and restores Super Moderator edit links on front-end bbPress user screens.

bbPress 2.6.18 requires PHP 7.2 or newer and WordPress 6.0 or newer. Sites running an older PHP version should update PHP before upgrading bbPress. Read the 2.6.18 upgrade notes for importer compatibility details.

These changes are also in the 2.7 development branch. The Plugin Directory’s development trunk remains at 2.7.0-alpha-3.

Download bbPress 2.6.18 from WordPress.org, or update from your WordPress dashboard.

(You may notice 2.6.17 release follows 2.6.15. Well, I found a SQL bug right after 2.6.16 was tagged and I didn’t want to wait to get that fix out, sooooo… here we are!)

This release strengthens inherited private and hidden forum visibility, BuddyPress Group Forum boundaries, subscriber access checks, profile editing, REST API and XML-RPC requests, search results, canonical redirects, topic tags, reply moves, topic splits, and output escaping.

It also includes a substantial overhaul of count maintenance and repair tools, improving topic, reply, forum, subforum, engagement, voice, and user contribution counts across moderation, moves, merges, splits, deletion, restoration, reassignment, and simultaneous requests. Block Themes now receive first-class support while continuing to use bbPress’s PHP templates, and the Plugin Directory gains a populated WordPress Playground preview.

Developers should review the 2.6.17 upgrade notes, especially if an integration hooks bbPress creation or moderation actions for counts, filters custom statuses or count values, customizes subforum queries, or overrides form-user-roles.php.

All of these changes have also been merged into the 2.7 development branch, which is now at 2.7.0-alpha-3.

Thank you to obenland, hoangkien1020, rafiem, faran66, im_rootkid, winty, winstoncrooker, vvh1te3zz, mickey_cyberkid, phanphanhailong, hieunx91, jassbugbounty, nextdoorsec, akemi20, amedit, djsplatt, antonade, foobar7, paulos__, and nomadsyndiode for contributing reports, patches, testing, and review. Thank you for helping keep bbPress communities safe and reliable!

Download bbPress 2.6.17 from WordPress.org, or update directly from your WordPress dashboard.

This release strengthens authorization around topic and reply editing, topic splitting and merging, user profile updates, and private or hidden forum visibility. It also hardens imported password verification, avoids PHP warnings on some forum requests, and improves compatibility with modern WordPress UTF-8 handling.

All of these fixes have already been merged into the 2.7 development branch.

Thank you to mickey_cyberkid, itznullbyte, eldoniis, and tristaninsec for reporting issues through HackerOne, and to Ananda Dhakal at Patchstack for reporting CVE-2026-74010. Thank you for helping keep bbPress communities safe!

Download bbPress 2.6.15 from WordPress.org, or update directly from your WordPress dashboard.

This release improves Akismet, BuddyPress, and PHP 8.2 support, moderation terms, search, and more!

(All of these fixes have already been merged into trunk/2.7.)

Thank you to everyone who contributed to this bbPress release!

(This fix is already merged into the 2.7 development branch.)

Thank you to vortfu, peterwilsoncc, spacedmonkey, joemcgill, swissspidy, and jorbin for helping communicate this to the bbPress team

The security issue was responsibly disclosed via the WordPress HackerOne bounty program. It does not appear to be actively exploited, and specifically targets: single-site WordPress installations, newer than 5.3.0, with the “Membership” setting set to “Anyone can register”, and with bbPress active.

(Even if that isn’t you, you should still update bbPress to 2.6.12 anyways!)

The minor bug was a regression to the search component introduced in 2.6.11, causing search results to not be as accurate as everyone deserves for them to be.

Both of these fixes are already merged into the 2.7 development branch.

Thank you to GDragoN and mungah (via HackerOne) for your help fixing bugs, and Robin W for keeping the bbPress.org Forums squeaky clean and well-supported! I really appreciate all of y’all!

Most notably, it improves HTML output escaping in the topic & reply forms (nothing serious, just some entities showing up where they should not), prevents a bunch of different debug notices from filling up error logs, and also updates some code to avoid deprecated notices from testing with the latest version(s) of WordPress itself.

All of these fixes have already been merged up into the 2.7 development branch.

If you’re paying really close attention, you may be wondering “hey John, what happened to 2.6.10?”

Well… I botched it. It’s been a while, ok? And 2.6.11 is good to go.

Huge thanks to Eusebiu, Kevin, and (as always) Robin W for being super fast with their feedback and just generally awesome!

Thank you to our friends over at Automattic’s Akismet team for helping!