Version 12.7.2

Versions 11.6.2, 12.7.2, and 14.5.2 are all BuddyPress security releases. They were released on July 29, 2026. 14.5.2 includes one security fix and a few code improvements.

For Version 12.7.2, the database version (_bp_db_version in wp_options) was 13422, and the Trac revision was 14235.

Security fixes

• Improve security of activity AJAX handlers.
  Before returning an activity item, be sure that the requesting user should be allowed to view the item.
  Special thanks to boonsuan1 (ho boon suan) who first reported this issue responsibly.

Other improvements

• Nouveau: Enforce ‘strong’ password level. See #9332.
• Avoid php8.4 deprecation notices. See #9337.

Contributors

Thanks for all of the help with this release! Contributors include boonsuan1 (ho boon suan), winstoncrooker (Winston Crooker), fran_hack_hu (Fran_hack_hu), waynezinn (wayne g), vvh1te3zz (Wao0o0o), niv09 (Niv), obsidiancladlabs (Charles), enable7_, hillng (Hill N), dealazer, r-a-y, dcavins, emaralive, johnjamesjacoby, and espellcaste,