phpBB Review

Plans & pricing

Prices last verified Nov 11, 2026

Free plan limits

The software itself sets no user or post caps; limits depend on the server you run it on.

Free trial

No free trial

phpBB alternatives

7.3/10

Discourse

Open-source forum software, self-hosted or on paid hosting

Open source

7.1/10

XenForo

Commercial forum software, one-time license or managed Cloud

Paid

Controversies & incidents

Issues documented by the press, regulators, courts or the vendor itself. Every item is sourced; unproven claims are labelled as allegations. Last researched: Nov 11, 2026

• Medium impactResolvedSecurity · Jun 1, 2026

  Authentication bypass and OAuth linking flaws fixed in 3.3.17

  Infosecurity Magazine reports that versions up to 3.3.16 let an unauthenticated attacker take over any account with a single request. phpBB fixed it on 6 June 2026.

  Read the full account

  Per Infosecurity Magazine (9 June 2026), PTT-2026-004 (CVSS 9.4), found by Dan Stefan Alexandru of Pentest-Tools.com, allowed takeover of any account, administrators included, on versions up to 3.3.16 using default database authentication and on the 4.0.0 alpha. A second flaw, PTT-2026-005 (CVSS 8.3), affected boards with OAuth login enabled and let an attacker bind their own OAuth credential to a victim's account. The Arabian Post gives the timeline: discovered 13 May, reported 4 June, fixed 6 June and detailed publicly on 8 June. Neither outlet reports exploitation in the wild. FreeBSD VuXML lists all versions before 3.3.17 as affected, along with a password-reset link poisoning flaw (CVE-2026-29199) fixed in 3.3.16.

  Vendor response

  phpBB released 3.3.17 on 6 June 2026 to fix both issues and urged administrators to upgrade, according to Infosecurity Magazine.

  Sources:Infosecurity Magazine: Critical phpBB flaw lets attackers hijack any accountThe Arabian Post: phpBB rushes patch for silent account hijackFreeBSD VuXML: phpBB multiple vulnerabilities

• Low impactResolvedSecurity · Jan 1, 2018

  phpBB 3.2.2 download links redirected to a third-party server

  On 26 January 2018 two download packages had their links altered for about three hours. phpBB said neither its servers nor its software were exploited.

  Read the full account

  Per Security Affairs, the full 3.2.2 package and the 3.2.1 to 3.2.2 updater were redirected to a server the project did not control from 12:02 to about 15:03 UTC. The entry point was a third-party site. Anyone who downloaded in that window was told to verify the SHA256 hash, and those who installed it to file an incident report.

  Vendor response

  phpBB said: "Neither phpBB.com nor the phpBB software were exploited in this attack."

  Sources:Security Affairs: phpBB download links compromised (2018)

• Medium impactResolvedSecurity · Dec 1, 2014

  phpBB.com servers compromised; members asked to change passwords

  In December 2014 attackers accessed phpBB's servers. Account data on phpbb.com and area51 was affected.

  Read the full account

  Per SecurityWeek (17 December 2014), phpBB said the attackers stole and used the credentials of a team member rather than exploiting a software flaw. Passwords were hashed and salted with PHPass; on area51, logins were additionally logged in plaintext between 12 and 15 December. phpBB said individual phpBB installations were not affected and there was no evidence the download packages had been modified.

  Vendor response

  phpBB asked users to change passwords and said it would rebuild its systems from scratch.

  Sources:SecurityWeek: phpBB asking users to change passwords (2014)