BuddyBoss Platform EUVD-2026-112999

Requires an authenticated low-privileged account (PR:L) on a WordPress site running BuddyBoss Platform version 3.5.0 or earlier; the attacker must be able to log in as at least a subscriber, which is frequently self-registerable on community sites using this plugin. No user interaction is needed (UI:N) and the vector is network-reachable (AV:N) with low complexity (AC:L). The main limiting factor is the authentication requirement - fully unauthenticated attackers cannot exploit it unless subscriber registration is open. The specific feature, endpoint, or configuration that performs the incorrect privilege assignment is not described in the available sources.

This is a credible, action-worthy issue but not a drop-everything emergency. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N) describes a network-reachable flaw with low attack complexity that requires some authentication - PR:L, consistent with the 'Subscriber Privilege Escalation' title, meaning an attacker needs only a low-privileged subscriber account, which on many BuddyBoss community sites is self-registerable. The CWE-266 (incorrect privilege assignment) and C:H/I:H/A:H impacts yield a base score of 8.8, reflecting that a subscriber could escalate to a substantially higher privilege level. The vuln.today priority label is 'this_week' rather than act_now/emergency, which aligns with the absence of other urgency signals: no CISA KEV listing is present, no EPSS probability was supplied, and no public exploit or PoC reference is provided (only a Patchstack advisory entry). So the signals are internally consistent - high technical severity, authenticated precondition, no evidence of active exploitation or published exploit code. MISSING DATA to note explicitly: EPSS score is not provided, KEV status is not provided (treat as not listed), and no fixed version appears in the available evidence. Prioritize remediation on a short timeline given low privilege requirement and self-registration being common on these sites, but this is not confirmed in-the-wild exploitation.

An attacker registers or obtains a low-privileged subscriber account on a WordPress site running BuddyBoss Platform 3.5.0 or earlier, then abuses an improperly assigned privilege check to grant themselves elevated capabilities (potentially administrative), gaining full read/write control and the ability to disrupt the site. No user interaction is required and attack complexity is low per the CVSS vector. No public exploit or working PoC was identified in the provided data; the exact trigger is not described in the available sources.