CVE-2025-14064
MEDIUMCVSS Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
Lifecycle Timeline
2Description
The BuddyTask plugin for WordPress is vulnerable to unauthorized access and modification of data due to a missing capability check on multiple AJAX endpoints in all versions up to, and including, 1.3.0. This makes it possible for authenticated attackers, with Subscriber-level access and above, to view, create, modify, and delete task boards belonging to any BuddyPress group, including private and hidden groups they are not members of.
Analysis
BuddyTask plugin for WordPress versions up to 1.3.0 fails to enforce capability checks on multiple AJAX endpoints, allowing authenticated subscribers and above to view, create, modify, and delete task boards in any BuddyPress group regardless of membership or group privacy settings. The CVSS 5.4 (Medium) rating reflects confidentiality and integrity impacts limited to group task data with low attack complexity and no user interaction required, though the actual organizational risk depends on BuddyPress deployment scope and task board sensitivity.
Technical Context
BuddyTask integrates with BuddyPress, a WordPress community plugin that provides group management and access controls. The vulnerability stems from CWE-862 (Missing Authorization) in AJAX endpoint handlers that process task board operations without verifying whether the authenticated user has the required group-level permissions or group membership. The affected AJAX handlers lack capability checks (likely using functions such as current_user_can() with appropriate group context) before executing database modifications on task board records. BuddyPress normally restricts access to private and hidden groups based on membership status, but BuddyTask's AJAX layer bypasses these restrictions by accepting authenticated requests from any subscriber-level user without re-validating group membership or permissions.
Affected Products
BuddyTask plugin for WordPress in all versions up to and including 1.3.0 is affected. The plugin integrates with BuddyPress and WordPress core. Affected WordPress installations running BuddyTask versions 1.3.0 and earlier are vulnerable. The vulnerability was confirmed in the 1.3.0 release branch and is present in the trunk development version as of the time of discovery, as evidenced by code inspection at multiple AJAX handler locations in the plugin source tree.
Remediation
Update BuddyTask to a patched version released after 1.3.0 that includes capability checks on all AJAX endpoints; consult the plugin changelog or the Wordfence vulnerability advisory at https://www.wordfence.com/threat-intel/vulnerabilities/id/0dfe0947-5790-49ba-aa3d-6bc61c12b355?source=cve for the exact patched version number and release date. As an interim workaround, administrators can restrict plugin functionality via access control lists or disable AJAX endpoints via .htaccess or firewall rules until patching is feasible; however, this may break legitimate task board functionality. WordPress administrators should review recent task board modifications by subscriber and contributor accounts in audit logs to detect potential unauthorized changes during the vulnerability exposure period.
Priority Score
Share
External POC / Exploit Code
Leaving vuln.today