bbPress 2.6.17
bbPress 2.6.17 is a security and maintenance release, released on September 16, 2026. It requires WordPress 6.0 or newer and PHP 5.6.20 or newer, and is tested through WordPress 7.1.
Everyone running bbPress should update as soon as possible.
What changed
This release strengthens access control and output handling throughout bbPress. It enforces inherited private and hidden forum visibility, checks current subscriber access before sending notifications, improves BuddyPress Group Forum boundaries, and applies bbPress permissions to REST API and XML-RPC requests. It also tightens profile editing, forum hierarchy and attribute changes, topic-tag removal, reply moves, topic splits, searches, canonical redirects, and several form and confirmation outputs.
bbPress 2.6.17 also includes substantial count and recount improvements. Topic, reply, forum, subforum, engagement, voice, and user contribution counts now remain synchronized across moderation, moves, merges, splits, deletion, restoration, reassignment, and concurrent requests. The repair tools handle the same status and visibility boundaries more consistently.
The release adds Block Theme support while continuing to use bbPress’s PHP templates, a populated WordPress Playground preview, and the bbp_post_updated action.
Upgrade notes
The upgrade does not synchronously recount every forum. Sites with known stale counts can selectively run the applicable tools under Tools > Forums > Repair Forums after upgrading. These tools can be expensive on large sites.
Themes that override form-user-roles.php should update their copy. The bundled template now honors field-level profile permissions introduced in this release.
Developer notes
bbPress now synchronizes its built-in public and hidden topic and reply counts, aggregate forum counts, and user contribution counts on bbp_transition_post_status at priority 10, after WordPress persists the new post status.
The existing bbp_new_*, bbp_insert_*, bbp_trash_*, bbp_untrash_*, bbp_spam_*, bbp_unspam_*, bbp_approve_*, and bbp_unapprove_* actions continue to fire with their existing arguments and timing. They no longer host bbPress’s built-in status-count callbacks. Extensions that need finalized status counts should use bbp_transition_post_status at priority 11 or later. Permanent deletion continues through bbp_deleted_topic and bbp_deleted_reply.
Count bump functions now use conditional metadata writes and bounded retries so simultaneous requests do not overwrite each other’s stored count changes. The bbp_pre_bump_count_meta, bbp_bump_count_meta_max_attempts, and bbp_bump_count_meta_types filters allow integrations to replace or adjust that behavior.
Subforum counts now update when forums are trashed, restored, permanently deleted, or moved. Extensions that customized subforum count membership through bbp_get_all_child_ids should use bbp_forum_query_subforum_ids, bbp_get_countable_forum_statuses, or the forum-status filters.
Release links
Contributors
Thank you to obenland, hoangkien1020, rafiem, faran66, im_rootkid, winty, winstoncrooker, vvh1te3zz, mickey_cyberkid, phanphanhailong, hieunx91, jassbugbounty, nextdoorsec, akemi20, amedit, djsplatt, antonade, foobar7, paulos__, and nomadsyndiode for contributing reports, patches, testing, and review to this release.
