It was brought to my attention this morning at 7am about a post in the 'unofficial' forums where a member raised a concern that people could see their forum profile details without being logged in.
The forum profile itself contains no private information, just a grey avatar image, and also shows forum activity.
I ran some tests - everything is fine - nothing is available to direct public access, where someone could 'stumble on' the information.
However, to address this particular concern, I reviewed how this could be done. If the nickname of a user is known, then a special url can be hand edited to look at their profile. This presupposes that the nickname of the user is known, and it is also known how to create that url! This is a problem with the Wordpress platform.
So - to confirm this - there is no direct public access to information where a non-logged in person can browse a person’s profile - it is only accessible by hand editing this url.
However, as this is a matter of concern, I have written some code to prevent this and it was in place this morning.
Thank you for bringing it to my attention.