bbPress 2.6.21
bbPress 2.6.21 is a security and maintenance release, released on October 27, 2026. It requires WordPress 6.0 or newer and PHP 7.2 or newer, and is tested through WordPress 7.1.
What changed
This release strengthens access control across forum feeds, search results, BuddyPress activity, group forums, attachment requests, topic moves, and old topic and reply redirects. Inherited forum passwords now apply consistently when WordPress renders topic and reply content, and Akismet moderation requests now require HTTPS.
Maintenance fixes improve forum freshness and child-count queries, preserve metadata when database lookups fail, tighten route and user-profile handling, retain original dates and revision content during moderation and editing, and correct the administration reply destination controls. Additional compatibility work repairs straightforward orphaned list items on WordPress 6.9 and newer without rewriting source markup, keeps generated bbPress excerpts available without duplicating content, and scopes registered count metadata to bbPress post types.
Topic and reply links now include the ugc relationship alongside nofollow. WordPress 7.2 and newer use refreshed SVG forum, topic, and reply administration icons, while older WordPress versions continue to use Dashicons.
Upgrade notes
The WordPress requirement remains 6.0 or newer, the PHP requirement remains 7.2 or newer, and the bbPress database version remains 264. No database upgrade is required.
Extensions that inspect topic and reply link relationships should allow the new ugc value. Extensions that filter forum freshness topic membership continue to use the existing compatibility path.
Developer notes
Forum freshness recalculation now uses bounded scalar lookups instead of loading complete public-topic ID sets into PHP. Existing filtered topic-membership behavior remains available through the legacy path. Failed activity lookups and visibility queries no longer overwrite known metadata or retain incomplete visibility caches.
BuddyPress activity collections consistently omit password-protected content, while direct reads retain the established password-cookie behavior. Group membership and community visibility checks now apply consistently to direct group-forum reads and front-end topic and reply submission.
Thanks to antaloaalonso, arielmeadow, bor0, Clorith, dd32, deborah86, diddledani, lmstearn, netweb, noruzzaman, Otto42, Pebbleontheshore, r-a-y, rollybueno, sbask, shadow043, SirLouen, softglaze, terresquall, tharsheblows, and ton-ha for contributions, reports, testing, and review included in this release.
