EUVD-2026-21658Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate as group admin or subscriber
-
ExploitSubmit groupblog settings with unauthorized parameters
-
ExecutionEscalate privileges to administrator role
-
ImpactAccess restricted blogs on multisite network
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2025 - Insecure Design
ASVS 5.0
V8 - Authorization Least privilege enforcement
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires WordPress Multisite with BuddyPress Groupblog plugin versions up to 1.9.3 enabled. Attacker must be authenticated as a Subscriber or higher privilege user capable of creating or administering a group. No victim interaction needed. |
| Impact | Critical privilege escalation affecting WordPress Multisite deployments. Authenticated Subscribers can escalate themselves or others to Administrator on the main site by exploiting missing authorization checks in group blog settings handlers. High impact due to direct admin access compromise and the low barrier to entry (Subscriber-level required). EPSS data unavailable; CVSS 8.8 reflects confidentiality, integrity, and availability compromise across the network. |
| Exploit ScenarioDerived | Authenticated Subscriber creates a group, manipulates |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Apr 11, 2026
Privilege escalation in BuddyPress Groupblog (WordPress plugin) allows authenticated attackers with Subscriber-level access to grant Administrator privileges on any blog in a Multisite network, including the main site. Exploitation leverages missing authorization checks in group blog settings handlers, enabling attackers to inject arbitrary WordPress roles (including administrator) and associate groups with any blog ID. When users join the compromised group, they are silently added to the targeted blog with the injected role. Authenticated access required (PR:L). No public exploit identified at time of analysis.
RemediationAI
Upstream fix available (commit b824593add9e2c53ef4f0d2e0824d4de0785411f on GitHub); released patched version not independently confirmed. Apply available patch from https://github.com/boonebgorges/bp-groupblog/commit/b824593add9e2c53ef4f0d2e0824d4de0785411f or monitor vendor advisory at https://www.wordfence.com/threat-intel/vulnerabilities/id/8129046a-5aa5-4644-babc-0eca9aa524d2?source=cve for patched release. Temporary mitigation: deactivate BuddyPress Groupblog plugin on all Multisite installations until patched version is confirmed available. Audit existing group configurations for unauthorized blog associations and review user role assignments on all network sites, especially the main site (blog ID 1). Restrict group creation capabilities to trusted user roles if plugin must remain active.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Root cause is missing authorization validation in group blog settings handler for groupblog-blogid, default-member, and groupblog-silent-add parameters (CWE-269). Handler accepts arbitrary blog IDs and WordPress roles without capability checks or whitelist validation, enabling horizontal privilege escalation through group membership propagation on WordPress Multisite installations.
Know when Buddypress Groupblog gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
DescriptionCVE.org
The BuddyPress Groupblog plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 1.9.3. This is due to the group blog settings handler accepting the groupblog-blogid, default-member, and groupblog-silent-add parameters from user input without proper authorization checks. The groupblog-blogid parameter allows any group admin (including Subscribers who create their own group) to associate their group with any blog on the Multisite network, including the main site (blog ID 1). The default-member parameter accepts any WordPress role, including administrator, without validation against a whitelist. When combined with groupblog-silent-add, any user who joins the attacker's group is automatically added to the targeted blog with the injected role. This makes it possible for authenticated attackers, with Subscriber-level access and above, to escalate any user (including themselves via a second account) to Administrator on the main site of the Multisite network.
Executive ViewAI
CVE-2026-5144 affects BuddyPress Groupblog, a WordPress plugin used in Multisite environments, allowing any Subscriber-level user to silently escalate themselves or others to Administrator across the network. This vulnerability bypasses role-based access controls entirely, enabling unauthorized administrative access to production blogs without detection. Organizations running WordPress Multisite with this plugin face immediate risk of account takeover, data theft, and site compromise by low-privilege insiders or existing user accounts.
No vendor-released patch identified at time of analysis. Interim mitigations: (1) Immediately deactivate the BuddyPress Groupblog plugin; (2) Restrict Subscriber user creation and review existing accounts; (3) Enable detailed audit logging for user role changes and group membership modifications; (4) Implement network-level monitoring for unauthorized Administrator role assignments; (5) Limit Multisite network access to trusted internal networks only; (6) Review and restrict which user roles can manage group blog associations.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
GitHub
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Privilege escalation occurs when an attacker leverages flaws in access control mechanisms to gain permissions beyond what they were originally granted.
Exploit-DB