Executive brief
BuddyPress is a popular WordPress plugin used to build social networking communities. A security flaw in its private messaging system allows any registered user on the site to read, modify, or delete the private messages of other members. This could lead to significant privacy breaches, the exposure of sensitive personal information, and unauthorized manipulation of user communications.
Technical details
An Insecure Direct Object Reference (IDOR) vulnerability exists in the BuddyPress REST API messaging endpoints (`/wp-json/buddypress/v1/messages/`). The root cause is a failure to properly validate the authorization of the requesting user against the `user_id` parameter provided in the query string. By supplying a victim's `user_id` as a parameter, an authenticated attacker (with Subscriber-level permissions or higher) can bypass authorization checks to read message threads, mark them as read/unread, or delete them entirely. This affects all versions prior to 14.5.0, where the fix ensures authorization is strictly tied to the actual logged-in user session rather than user-supplied parameters.
Affected products
- BuddyPress BuddyPress < 14.5.0
Timeline
- 2026-07-13: disclosed: Initial public disclosure by WPScan
- 2026-07-13: patched: Fixed in version 14.5.0
- 2026-07-31: advisory: CVE published to NVD