EUVD-2026-51429
GHSA-6pp9-x443-r8xw
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
Network-accessible endpoints, low complexity; PR:L reflects mandatory Subscriber authentication; no scope change, no availability impact.
Primary rating from Vendor (WPScan).
CVSS VectorVendor: WPScan
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
Lifecycle Timeline
5DescriptionCVE.org
The BuddyPress WordPress plugin before 14.5.0 does not properly enforce authorization on its private messaging endpoints, allowing any authenticated user (Subscriber+) to read, modify, or delete other users' private messages.
AnalysisAI
Broken object-level authorization (IDOR) in the BuddyPress WordPress plugin, all versions before 14.5.0, permits any authenticated user at the Subscriber level or above to read, modify, or delete private messages belonging to other users via the plugin's messaging endpoints. A publicly available proof-of-concept exists per WPScan reporting, though EPSS data places exploitation probability at just 0.13% (3rd percentile) and SSVC classification marks it as not automatable, indicating exploitation is currently opportunistic and targeted rather than widespread. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires an active authenticated session on the WordPress site at Subscriber privilege level or higher (PR:L per CVSS vector) - unauthenticated access is not sufficient. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 5.4 Medium score reflects a balanced but real risk: network-accessible (AV:N), low complexity (AC:L), and low privilege (PR:L) make exploitation straightforward for any registered user, while the unchanged scope (S:U) and partial C/I impacts cap the ceiling. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker registers or already holds a low-privilege WordPress account (Subscriber) on a target site running BuddyPress, then probes the private messaging REST or AJAX endpoints with sequentially or randomly enumerated message thread IDs. Because authorization is not enforced, the attacker successfully retrieves the full content of private conversations between other users, or alters/deletes messages to disrupt communications. … |
| Remediation | The primary remediation is to upgrade BuddyPress to version 14.5.0 or later, which contains the vendor-released authorization fix per the WPScan advisory at https://wpscan.com/vulnerability/b7dd9cbf-b46b-49ee-84a0-6b054676fccb/. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Buddypress
View allBuddyPress is an open source WordPress plugin to build a community site. Rated high severity (CVSS 8.8), this vulnerabil
SQL injection vulnerability in wp-load.php in the BuddyPress plugin 1.5.x before 1.5.5 of WordPress allows remote attack
The BuddyPress plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 14.1.0 vi
PHP object injection in the BuddyPress plugin for WordPress (all versions through 14.5.0) allows authenticated users wit
In BuddyPress before 5.1.2, requests to a certain REST API endpoint can result in private user data getting exposed. Rat
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in The BuddyPress Com
The BuddyPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘display_name’ parameter in ver
The BuddyPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘user_name’ parameter in versio
Cross-site scripting (XSS) vulnerability in the BuddyPress plugin before 1.9.2 for WordPress allows remote authenticated
An issue was discovered in includes/component.php in the BuddyPress Docs plugin before 1.9.3 for WordPress. Rated medium
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today