Version 11.6.0

Versions 11.6.0, 12.7.0, and 14.5.0 are all BuddyPress security releases. They were released on July 7, 2026. Two security fixes were introduced.

For Version 11.6.0, the database version (_bp_db_version in wp_options) was 13422, and the Trac revision was 14212.

Security fixes

• Improve security of messages endpoint.
  In the REST API messages endpoint, sanitize the incoming user_id parameter value to avoid user spoofing.
  Special thanks to trihedron who first reported this issue responsibly.
  Props emaralive, jjj, espellcaste, trihedron, substitute99, j2k14a, g_r_i_n_n, pythonime, dizconnect (Sanjorn Keeratirungsan), eneednar19, bb-hunter (Mustafa Ahmed), yhalo (Yaohui Wang), Ngo Anh Duc, ekbreks, jeromewincek (Jerome Wincek), taylsec, ajaah-254, izumi_hyun, mickey_cyberkid (Michael Okyere), underdog_theori, duyytrann (Duy Tran), safe-us (Safe Us Team), miauuu, daupaul (Dau-Po Yu).
• Components: Restrict updates to site admins.
  Ensure that the current user has the `manage_options` capability before allowing them to change BuddyPress component status.
  Special thanks to kasthelord (Lukas Collishaw) who first reported this issue responsibly.
  Props emaralive, jjj, espellcaste, kasthelord (Lukas Collishaw), 1353594865qq, jeromewincek (Jerome Wincek), vvh1te3zz.