bbPress 2.6.15 is a security and maintenance release that fixes five security issues and includes a few compatibility improvements. Everyone running bbPress should update as soon as possible. 
This release strengthens authorization around topic and reply editing, topic splitting and merging, user profile updates, and private or hidden forum visibility. It also hardens imported password verification, avoids PHP warnings on some forum requests, and improves compatibility with modern WordPress UTF-8 handling.
All of these fixes have already been merged into the 2.7 development branch.
Thank you to mickey_cyberkid, itznullbyte, eldoniis, and tristaninsec for reporting issues through HackerOne, and to Ananda Dhakal at Patchstack for reporting CVE-2026-74010. Thank you for helping keep bbPress communities safe! 
Download bbPress 2.6.15 from WordPress.org, or update directly from your WordPress dashboard.