I am not a bbpress author, just a moderator on the support forum.

bbpress has been informed, and patchstack says that the issue is

Low priority
No impactful threat
This security issue has a low severity impact and is unlikely to be exploited.

But of course it should be fixed.

I am closing this thread as another exists covering the same issue

For context, we’d been working on a few issues together but we can’t control their timeline, and I considered the circumstances of that issue (anonymous posting enabled, editing enabled) low enough of a footprint to not consider it as urgent as other issues in the pipeline.

And the good news is that 2.6.15 was released today.

Thanks for trying to keep us in the loop!