Executive brief
BuddyPress, a popular social networking plugin for WordPress, contains a security flaw that allows any logged-in user to view the private friend lists of other members. By exploiting this issue, an attacker could map out the social connections of any user on the platform, potentially leading to privacy violations or targeted social engineering. This impacts the confidentiality of user data and the overall privacy reputation of the community site.
Technical details
An Insecure Direct Object Reference (IDOR) vulnerability exists in the BuddyPress friends REST API due to insufficient authorization checks in the 'get_items_permissions_check' method. While the method verifies that a requester is authenticated, it fails to validate if the requester has permission to view the specific 'user_id' requested. A remote authenticated attacker can exploit this by sending crafted REST API requests with arbitrary user IDs to disclose private social connections. The vulnerability affects versions up to and including 14.4.0; users should look for maintenance releases such as 14.5.2 or later for potential fixes.
Affected products
- BuddyPress BuddyPress <= 14.4.0
Timeline
- 2026-06-10: disclosed: Initial disclosure date
- 2026-06-10: advisory: GitHub Advisory published