WordPress security changelog
LOW CVE-2024-12767 Modified

buddyboss-platform: A security weakness

buddyboss-platform is affected by a security weakness. Exposure depends on how the affected operation is made reachable by the site. The resulting impact depends on how the affected component exposes the vulnerable operation.

CVE / CNA score 3.5 CVSS 3.1 · 134c704f-9b21-4f2e-91b3-4a467353bcc0
NVD score Pending NVD has not published its own CVSS assessment.
Component
buddyboss-platform
Plugin slug
buddyboss-platform
Affected
See vendor advisory
Safe version
See mitigation notes
Published
May 15, 2025
Weakness
CWE-639 — Authorization Bypass Through User-Controlled Key

This CVE was published May 15, 2025 and is one of 8 known issues for this plugin.

What to do

Patch or disable the affected component.

Update buddyboss-platform to a release outside the affected range, or disable and remove it until a fixed version is available.

Source record

Technical description

The buddyboss-platform WordPress plugin before 2.7.60 lacks proper access controls and allows a logged-in user to view comments on private posts

CVE / CNA vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N

References

Primary and upstream sources