This release improves Akismet, BuddyPress, and PHP 8.2 support, moderation terms, search, and more!

(All of these fixes have already been merged into trunk/2.7.)

Thank you to everyone who contributed to this bbPress release!

(This fix is already merged into the 2.7 development branch.)

Thank you to vortfu, peterwilsoncc, spacedmonkey, joemcgill, swissspidy, and jorbin for helping communicate this to the bbPress team

The security issue was responsibly disclosed via the WordPress HackerOne bounty program. It does not appear to be actively exploited, and specifically targets: single-site WordPress installations, newer than 5.3.0, with the “Membership” setting set to “Anyone can register”, and with bbPress active.

(Even if that isn’t you, you should still update bbPress to 2.6.12 anyways!)

The minor bug was a regression to the search component introduced in 2.6.11, causing search results to not be as accurate as everyone deserves for them to be.

Both of these fixes are already merged into the 2.7 development branch.

Thank you to GDragoN and mungah (via HackerOne) for your help fixing bugs, and Robin W for keeping the bbPress.org Forums squeaky clean and well-supported! I really appreciate all of y’all!

Most notably, it improves HTML output escaping in the topic & reply forms (nothing serious, just some entities showing up where they should not), prevents a bunch of different debug notices from filling up error logs, and also updates some code to avoid deprecated notices from testing with the latest version(s) of WordPress itself.

All of these fixes have already been merged up into the 2.7 development branch.

If you’re paying really close attention, you may be wondering “hey John, what happened to 2.6.10?”

Well… I botched it. It’s been a while, ok? And 2.6.11 is good to go.

Huge thanks to Eusebiu, Kevin, and (as always) Robin W for being super fast with their feedback and just generally awesome!

Thank you to our friends over at Automattic’s Akismet team for helping!

Thank you to everyone who provided prompt feedback in the support forums. Because of you, we were able to react quickly and repackage this release right away.

This release improves Akismet and BuddyPress support, allows Moderators to reply to unapproved Topics, and fixes a user-interface issue with the hierarchical replies feature, just to highlight a few notable changes.

Thank you to everyone who contributed to this bbPress release!

This release fixes a few PHP warnings & notices, some output formatting bugs, and improves a few different moderator experiences, just to name a few of my favorite changes.

As always, thank you for choosing bbPress. It means a lot to our team that you and over 300,000 others entrust us with powering your community.

Special thanks to the following folks for improving the security of bbPress:

• Raphael Karger for disclosing an unauthenticated privilege escalation when New User Registration is enabled
• hoangkien1020 for disclosing an authenticated privilege escalation via the Super Moderator feature
• Binit Ghimire for reporting the potential for a self-XSS via the Forums list-table

Also in this release are: various typographical fixes, a few PHP warnings & notices were eradicated, more accurate escaping of Search results, and support for some recently added WordPress Plugin headers.

This security release came together very quickly, with the help of several WordPress Core, Meta Team, and Security Team members. I appreciate all of your help today.

Another big shoutout to my employer, Sandhills Development, for allowing me the freedom to responsibly shirk my plans for today, enabling me to focus on getting this release out ASAP.

• Fixes an obscure security issue with BuddyPress Group Forums, allowing Group Members to save Topics to invalid Forum IDs
• Fixes performance degradation for 2.5 database schemas
• Fixes a few typos
• Fixes some debug notices
• Fixes user email changes using the wrong API
• Improves compatibility with PHP 7.2 and higher

Special thanks to Yuvraj Dighe for his responsible disclosure of the BuddyPress Group Forums bug over at HackerOne. Thank you for helping improve bbPress.

Work continues on improving bbPress 2.6 while also doing a bit more clean-up for 2.7.

Expect for the next minor release (bbPress 2.6.5) to be released sometime before March 1.