bbPress 2.6.19 is a security and maintenance release. Everyone running bbPress should update. 
This release applies inherited forum passwords to REST API responses and BuddyPress activity, and strengthens access checks for restricted forum content across feeds, group forums, and other indirect views. It also tightens moderation and forum-role permissions, protects importer credentials and account handling, and improves escaping in profile and administration output.
There are maintenance fixes for BuddyPress group-forum associations and notifications, converter cleanup, imported database passwords, subscription emails, and reply positioning. The 2.6.19 upgrade notes cover integration details. bbPress still requires WordPress 6.0 or newer and PHP 7.2 or newer. The automatic database version 264 upgrade clears saved converter query SQL from older password upgrades.
These changes are also in the 2.7 development branch, which is now 2.7.0-alpha-4. Thank you to thewindghost, ngonhuy, and moltenbit for responsibly reporting issues fixed in this release, and to everyone who helped review and test the changes.
Download bbPress 2.6.19 from WordPress.org, or update from your WordPress dashboard.
