What is the CVSS score of CVE-2026-5144?

CVE-2026-5144 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of WordPress are affected by CVE-2026-5144?

CVE-2026-5144 affects BuddyPress Groupblog, a WordPress plugin used in Multisite environments, allowing any Subscriber-level user to silently escalate themselves or others to Administrator across the…

How to fix or mitigate CVE-2026-5144?

Within 24 hours: Identify all WordPress Multisite installations with BuddyPress Groupblog enabled using plugin audit tools; document the installed version and number of Subscriber-level users with network access. Within 7 days: Immediately disable or deactivate the BuddyPress Groupblog plugin across all affected Multisite networks; audit user roles on all blogs for unauthorized Administrator accounts added post-plugin deployment; reset credentials for all Subscriber accounts. Within 30 days: Replace BuddyPress Groupblog with a patched alternative when available from the vendor; implement role-based access control (RBAC) monitoring; conduct forensic log review of group membership and role assignment activities for the past 90 days.

WordPress CVE-2026-5144

EUVD-2026-21658 HIGH

Improper Privilege Management (CWE-269)

2026-04-11 Wordfence

WordPress Privilege Escalation

8.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.8 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Re-analysis Queued

Apr 24, 2026 - 18:07 vuln.today

cvss_changed

EUVD ID Assigned

Apr 11, 2026 - 01:30 euvd

EUVD-2026-21658

Analysis Generated

Apr 11, 2026 - 01:30 vuln.today

CVE Published

Apr 11, 2026 - 01:24 nvd

HIGH 8.8

DescriptionCVE.org

The BuddyPress Groupblog plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 1.9.3. This is due to the group blog settings handler accepting the groupblog-blogid, default-member, and groupblog-silent-add parameters from user input without proper authorization checks. The groupblog-blogid parameter allows any group admin (including Subscribers who create their own group) to associate their group with any blog on the Multisite network, including the main site (blog ID 1). The default-member parameter accepts any WordPress role, including administrator, without validation against a whitelist. When combined with groupblog-silent-add, any user who joins the attacker's group is automatically added to the targeted blog with the injected role. This makes it possible for authenticated attackers, with Subscriber-level access and above, to escalate any user (including themselves via a second account) to Administrator on the main site of the Multisite network.

AnalysisAI

Privilege escalation in BuddyPress Groupblog (WordPress plugin) allows authenticated attackers with Subscriber-level access to grant Administrator privileges on any blog in a Multisite network, including the main site. Exploitation leverages missing authorization checks in group blog settings handlers, enabling attackers to inject arbitrary WordPress roles (including administrator) and associate groups with any blog ID. When users join the compromised group, they are silently added to the targeted blog with the injected role. Authenticated access required (PR:L). No public exploit identified at time of analysis.

Technical ContextAI

Root cause is missing authorization validation in group blog settings handler for groupblog-blogid, default-member, and groupblog-silent-add parameters (CWE-269). Handler accepts arbitrary blog IDs and WordPress roles without capability checks or whitelist validation, enabling horizontal privilege escalation through group membership propagation on WordPress Multisite installations.

RemediationAI

Upstream fix available (commit b824593add9e2c53ef4f0d2e0824d4de0785411f on GitHub); released patched version not independently confirmed. Apply available patch from https://github.com/boonebgorges/bp-groupblog/commit/b824593add9e2c53ef4f0d2e0824d4de0785411f or monitor vendor advisory at https://www.wordfence.com/threat-intel/vulnerabilities/id/8129046a-5aa5-4644-babc-0eca9aa524d2?source=cve for patched release. Temporary mitigation: deactivate BuddyPress Groupblog plugin on all Multisite installations until patched version is confirmed available. Audit existing group configurations for unauthorized blog associations and review user role assignments on all network sites, especially the main site (blog ID 1). Restrict group creation capabilities to trusted user roles if plugin must remain active.