bbPress 2.6.20
bbPress 2.6.20 is a security and maintenance release, released on October 15, 2026. It requires WordPress 6.0 or newer and PHP 7.2 or newer, and is tested through WordPress 7.1.
What changed
This release strengthens topic and reply password validation and keeps bbPress post shortcodes literal in ordinary WordPress content loops. It adds a site-wide Forum Status setting with Open, Closed, and Frozen modes, and an optional date format parameter for topic and reply post-date template functions.
BuddyPress fixes preserve the displayed member when privileged users manage favorites or subscriptions, keep group topic routes and titles scoped to the requested topic, use the supported BuddyPress 15 activity SQL filter, and restore access and navigation behavior for group forums. Additional fixes cover moderation forms and actions, restricted-content visibility, subscription links, deferred notifications, converters, widgets, profiles, counts, and topic and reply administration.
Upgrade notes
The WordPress requirement remains 6.0 or newer, the PHP requirement remains 7.2 or newer, and the bbPress database version remains 264. No database upgrade is required.
The new site-wide Forum Status defaults to Open, preserving existing behavior. Closed allows Keymasters and Moderators to add topics and replies. Frozen stops new topics and replies and limits edits to Keymasters and Moderators, while still permitting BuddyPress Group Forum creation.
Authors may now edit existing topics and replies after their topic or forum is closed, while closed topics remain publicly readable. Closing continues to prevent ordinary users from adding new content. Third-party theme packages that validate subscription-link nonces regain compatibility with the original nonce format.
Developer notes
bbp_get_topic_post_date() and bbp_get_reply_post_date() accept an optional date format parameter. Existing calls remain compatible.
The site-wide status API includes bbp_get_forums_statuses(), bbp_get_forums_status(), bbp_is_forums_status(), bbp_user_can_post_in_forums(), and bbp_user_can_edit_in_forums(), with filters on the status list and permission decisions.
Front-end merge, split, and move forms now preserve their action across GET and POST requests when validation fails. The public threaded-replies setting filter is applied while the legacy underscored hook remains available. The complete changelog records the individual security and maintenance fixes.
