CVE-2024-12145 buddypress CVE debrief

Who should care

WordPress administrators and security teams responsible for managing BuddyPress plugin installations should assess their exposure and prioritize remediation. This includes reviewing user access controls, notification management, and applying vendor remediation when available. Security teams should also monitor for suspicious notification activity and review compensating controls for exposed systems.

Why it matters

CVE-2024-12145 BuddyPress plugin vulnerability requires assessment and remediation to prevent unauthorized notification manipulation

• Authenticated attackers with Subscriber-level access can delete, mark as read, or mark as unread notifications of other users
• Potential for unauthorized access to sensitive information
• Need for prompt assessment and remediation of vulnerable BuddyPress plugin installations

Technical summary

The BuddyPress plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 14.3.3 via the bp_notifications_action_bulk_manage due to missing validation on a user controlled key. This vulnerability allows authenticated attackers with Subscriber-level access and above to delete/mark as read/mark as unread notifications of other users. The technical impact of this vulnerability is that an attacker could potentially access and manipulate sensitive notification information.

Defensive priority

Assess exposure and prioritize remediation for WordPress installations using the BuddyPress plugin.

Recommended defensive actions

• Assess WordPress installations for BuddyPress plugin usage and version
• Verify user access controls and notification management
• Apply vendor remediation when available
• Monitor for suspicious notification activity
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The vulnerability is due to missing validation on a user-controlled key in the bp_notifications_action_bulk_manage function. This allows attackers to manipulate notifications of other users. Evidence of this vulnerability includes reports from security researchers and affected users. The CVE record and NVD detail provide further information on the vulnerability. Defenders should verify the presence of the BuddyPress plugin and review user access controls and notification management.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.