BuddyPress

BuddyPress before 14.5.0 does not enforce message ownership on its private-messaging endpoints. Any authenticated Subscriber-or-higher user can select another user's private message and read its contents, modify it or delete it. The published record does not identify the exact endpoint routes, message-ID parameter, authorization callback or message operation functions.

BuddyPress 14.5.0 and earlier lets any authenticated member, including a Subscriber, submit a serialized PHP object as the value of one of their own XProfile text-box fields. The editable REST route /wp-json/buddypress/v1/xprofile/{field_id}/data/{user_id} accepts the attacker-controlled value parameter and passes it through update_item() to xprofile_set_field_data(); the ordinary Profile > Edit form provides the same write path through field_{field_id}. BuddyPress stores the crafted value, then rendered-profile paths including get_profile_field_rendered_value() pass it to bp_unserialize_profile_field(), whose unrestricted @unserialize() permits object instantiation. Exploitation requires a suitable POP gadget chain already loaded by WordPress, BuddyPress, the theme or another plugin; if one exists, attacker-controlled magic methods can produce remote code execution and full confidentiality, integrity and availability impact. Neither the CNA record nor the cited upstream source identifies a specific usable POP chain, so practical impact is environment-dependent.

BuddyPress is affected by a security weakness. Exploitation requires an authenticated WordPress account. The resulting impact depends on how the affected component exposes the vulnerable operation. The published affected range is <= 14.4.0.

BuddyPress is affected by a security weakness. Exposure depends on how the affected operation is made reachable by the site. The resulting impact depends on how the affected component exposes the vulnerable operation. The published affected range is <= 14.4.0.

BuddyPress is affected by a security weakness. Exploitation requires an authenticated WordPress account. The resulting impact depends on how the affected component exposes the vulnerable operation. The published affected range is <= 14.4.0.

Buddypress is affected by cross-site scripting. Exploitation requires an authenticated WordPress account. Injected script can execute in the affected site's origin when the vulnerable output is viewed. The published affected range is 6.2.0.

The BuddyPress is affected by a security weakness. The vulnerable path is reachable without authentication. The resulting impact depends on how the affected component exposes the vulnerable operation.

BuddyPress is affected by a security weakness. Exposure depends on how the affected operation is made reachable by the site. The resulting impact depends on how the affected component exposes the vulnerable operation.

Mass Messaging in BuddyPress is affected by cross-site scripting. Exposure depends on how the affected operation is made reachable by the site. Injected script can execute in the affected site's origin when the vulnerable output is viewed.

BuddyPress is affected by filesystem traversal. Exploitation requires at least subscriber-level access. A crafted path can escape the intended directory and reach files or directories elsewhere on the server.

BuddyPress is affected by cross-site scripting. Exploitation requires an authenticated WordPress account. Injected script can execute in the affected site's origin when the vulnerable output is viewed.

BuddyPress is affected by cross-site scripting. Exploitation requires an authenticated WordPress account. Injected script can execute in the affected site's origin when the vulnerable output is viewed.

BuddyPress is affected by cross-site scripting. Exposure depends on how the affected operation is made reachable by the site. Injected script can execute in the affected site's origin when the vulnerable output is viewed.

Buddypress is affected by a security weakness. Exposure depends on how the affected operation is made reachable by the site. The resulting impact depends on how the affected component exposes the vulnerable operation.

Buddypress is affected by a security weakness. Exposure depends on how the affected operation is made reachable by the site. The resulting impact depends on how the affected component exposes the vulnerable operation.

Buddypress is affected by cross-site scripting. The vulnerable path is reachable without authentication. Injected script can execute in the affected site's origin when the vulnerable output is viewed.

Buddypress is affected by SQL injection. Exposure depends on how the affected operation is made reachable by the site. A successful request can alter database queries and expose or modify WordPress data.