Executive brief
BuddyPress, a popular community-building plugin for WordPress, contains a security flaw in its private messaging system. An authenticated user can exploit this to read, reply to, or delete private messages belonging to any other user on the site. This could lead to significant privacy breaches, unauthorized communication, and loss of sensitive user data.
Technical details
An Insecure Direct Object Reference (IDOR) vulnerability exists in the BuddyPress messages REST API due to improper validation in the get_item_permissions_check method. The method incorrectly validates a user-supplied user_id parameter instead of the identity of the currently logged-in user. Because this permission check is reused by update and delete handlers, an authenticated attacker can provide an arbitrary user's ID to read, reply to, or delete their private message threads. The vulnerability is addressed in version 14.5.0.
Affected products
- BuddyPress BuddyPress 14.4.0
Timeline
- 2026-06-10: disclosed
- 2026-06-10: advisory
- 2026-08-12: patched: Advisory updated to reflect patch availability in 14.5.0