Skip to content
OpenAdvisories
Critical · 9.8 Public exploit CVE-2025-31033 EUVD-2025-10651GHSA-jqxw-j9cr-8v8p

WordPress Buddypress Humanity plugin <= 1.2 - CSRF to Privilege Escalation vulnerability

Published Apr 9, 2025 · Updated Apr 28, 2026 · Assigned by Patchstack

Vendor: Adam Nowak Product: Buddypress Humanity

Description

Cross-Site Request Forgery (CSRF) vulnerability in Adam Nowak Buddypress Humanity buddypress-humanity allows Cross Site Request Forgery.This issue affects Buddypress Humanity: from n/a through <= 1.2.

Affected products

VendorProductAffectedFixed
Adam Nowak Buddypress Humanity ≤ 1.2 —

Public exploits

Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.

Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.

GitHub 1 repository

  • Nxploited/CVE-2025-31033 ★ 0 · Apr 10, 2025

    WordPress Buddypress Humanity Plugin <= 1.2 is vulnerable to Cross Site Request Forgery (CSRF)

Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.

References