Description
The BuddyPress WordPress plugin before 14.5.0 does not properly enforce authorization on its private messaging endpoints, allowing any authenticated user (Subscriber+) to read, modify, or delete other users' private messages.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| — | BuddyPress | < 14.5.0 | 14.5.0 |
References
- https://wpscan.com/vulnerability/b7dd9cbf-b46b-49ee-84a0-6b054676fccb/ exploit vdb-entry technical-description