BuddyPress EUVD-2026-51429

Exploitation requires an active authenticated session on the WordPress site at Subscriber privilege level or higher (PR:L per CVSS vector) - unauthenticated access is not sufficient. The BuddyPress plugin must be installed, activated, and the private messaging component must be enabled (non-default WordPress, requires BuddyPress to be present). The attacker must supply valid message or thread IDs belonging to other users, which implies some degree of ID enumeration or prior knowledge - this is the limiting factor identified by SSVC's 'automatable: no' classification. Exploitation is constrained to the messaging subsystem only; it does not grant broader WordPress admin access, file system access, or code execution. Sites that have disabled the BuddyPress messaging component or that restrict user registration are not exploitable.

The CVSS 5.4 Medium score reflects a balanced but real risk: network-accessible (AV:N), low complexity (AC:L), and low privilege (PR:L) make exploitation straightforward for any registered user, while the unchanged scope (S:U) and partial C/I impacts cap the ceiling. EPSS at 0.13% (3rd percentile) is very low, but this is consistent with the SSVC signal of 'automatable: no' - exploitation likely requires some message ID enumeration, preventing fully scripted mass attacks. The public POC reported by WPScan lowers the technical barrier and is the primary escalating signal here. The absence of a CISA KEV listing suggests no confirmed in-the-wild exploitation campaigns at time of analysis. The real-world priority is higher than the EPSS suggests for sites where private messaging is a core trust feature (counseling platforms, member communities, HR portals): exposure of private correspondence carries regulatory and reputational consequences beyond what CVSS impact metrics capture. No data conflicts are present - the CVSS vector, description, and SSVC are mutually consistent.

An attacker registers or already holds a low-privilege WordPress account (Subscriber) on a target site running BuddyPress, then probes the private messaging REST or AJAX endpoints with sequentially or randomly enumerated message thread IDs. Because authorization is not enforced, the attacker successfully retrieves the full content of private conversations between other users, or alters/deletes messages to disrupt communications. A proof-of-concept is publicly available via WPScan, reducing the skill required to carry out this scenario.