Executive brief
BuddyPress is a popular WordPress plugin that adds social networking features like user profiles, activity streams, and messaging. A flaw in its notification management system allows authenticated users (even with basic Subscriber-level access) to view, delete, or modify notifications belonging to other users without authorization. An attacker could exploit this to suppress security alerts, delete important notifications, or interfere with other users' accounts.
Technical details
The vulnerability is an Insecure Direct Object Reference (IDOR) in the bp_notifications_action_bulk_manage function of BuddyPress versions up to 14.3.3. The function fails to validate that a user-controlled key corresponds to the current user's own notifications before performing delete, mark-as-read, or mark-as-unread operations. An authenticated attacker with Subscriber-level or higher access can craft requests to manipulate notifications belonging to arbitrary users. No special privileges or user interaction is required beyond initial authentication. A patch is available in WordPress plugin repositories for versions after 14.3.3.
Affected products
- BuddyPress BuddyPress up to and including 14.3.3
Timeline
- 2024-09-11: disclosed