The BuddyPress

BuddyPress through 14.3.3 accepts a user-controlled key in bp_notifications_action_bulk_manage without validating that the referenced notification belongs to the caller. An authenticated Subscriber can delete another user's notifications or mark them read or unread. The authoritative export identifies the action and vulnerable key but does not disclose the request route or parameter name carrying the key.

BuddyPress before 14.5.0 does not enforce message ownership on its private-messaging endpoints. Any authenticated Subscriber-or-higher user can select another user's private message and read its contents, modify it or delete it. The published.

BuddyPress 14.5.0 and earlier lets any authenticated member, including a Subscriber, submit a serialized PHP object as the value of one of their own XProfile text-box fields. The editable REST route /wp-json/buddypress/v1/xprofile/{field_id}/data/{user_id} accepts the attacker-controlled value parameter and passes it through update_item() to xprofile_set_field_data(); the ordinary Profile > Edit form provides the same write path through field_{field_id}. BuddyPress stores the crafted value, then rendered-profile paths including get_profile_field_rendered_value() pass it to bp_unserialize_profile_field(), whose unrestricted @unserialize() permits object instantiation. Exploitation requires a suitable POP gadget chain already loaded by WordPress, BuddyPress, the theme or another plugin; if one exists, attacker-controlled magic methods can produce remote code execution and full confidentiality, integrity and availability impact. Neither the CNA record nor the cited upstream source identifies a specific usable POP chain, so practical impact is environment-dependent.

BuddyPress is affected by broken access control. Exploitation requires an authenticated WordPress account. A successful request can reach data or an operation that should be restricted to another user or a more privileged role. The published affected range is <= 14.4.0.

BuddyPress is affected by denial of service. Exposure depends on how the affected operation is made reachable by the site. A successful request can exhaust or disrupt the affected operation and make site functionality unavailable. The published affected range is <= 14.4.0.

BuddyPress is affected by broken access control. Exploitation requires an authenticated WordPress account. A successful request can reach data or an operation that should be restricted to another user or a more privileged role. The published affected range is <= 14.4.0.

Buddypress is affected by cross-site scripting. Exploitation requires an authenticated WordPress account. Injected script can execute in the affected site's origin when the vulnerable output is viewed. The published affected range is 6.2.0.

The BuddyPress is affected by a security weakness. The vulnerable path is reachable without authentication. The resulting impact depends on how the affected component exposes the vulnerable operation.

BuddyPress is affected by a security weakness. Exposure depends on how the affected operation is made reachable by the site. The resulting impact depends on how the affected component exposes the vulnerable operation.

Mass Messaging in BuddyPress is affected by cross-site scripting. Exposure depends on how the affected operation is made reachable by the site. Injected script can execute in the affected site's origin when the vulnerable output is viewed.

BuddyPress is affected by filesystem traversal. Exploitation requires an authenticated subscriber account. A crafted path can escape the intended directory and reach files or directories elsewhere on the server.

BuddyPress is affected by cross-site scripting. Exploitation requires an authenticated subscriber account. Injected script can execute in the affected site's origin when the vulnerable output is viewed.

BuddyPress is affected by cross-site scripting. Exploitation requires an authenticated subscriber account. Injected script can execute in the affected site's origin when the vulnerable output is viewed.

BuddyPress is affected by cross-site scripting. Exposure depends on how the affected operation is made reachable by the site. Injected script can execute in the affected site's origin when the vulnerable output is viewed.

Buddypress is affected by a security weakness. Exposure depends on how the affected operation is made reachable by the site. The resulting impact depends on how the affected component exposes the vulnerable operation.

Buddypress is affected by a security weakness. Exposure depends on how the affected operation is made reachable by the site. The resulting impact depends on how the affected component exposes the vulnerable operation.

Buddypress is affected by cross-site scripting. The vulnerable path is reachable without authentication. Injected script can execute in the affected site's origin when the vulnerable output is viewed.

Buddypress is affected by SQL injection. Exposure depends on how the affected operation is made reachable by the site. A successful request can alter database queries and expose or modify WordPress data.