The BuddyPress plugin for WordPress is vulnerable to Insecure Direct Object Reference, allowing authenticated attackers with Subscriber-level access to delete, mark as read, or mark as unread notifications of other users. This vulnerability affects WordPress installations using the BuddyPress plugin, particularly those with user management and notification features. The vulnerability requires assessment a [truncated]
The BuddyPress WordPress plugin before 14.5.0 does not properly enforce authorization on its private messaging endpoints, allowing any authenticated user (Subscriber+) to read, modify, or delete other users' private messages. This issue has a CVSS score of 5.4 and is classified as MEDIUM severity. The vulnerability is characterized by CWE-639, indicating improper authorization. This could lead to unauthor [truncated]
CVE-2026-53675 is a MEDIUM-severity vulnerability in BuddyPress 14.4.0. The vulnerability is an insecure direct object reference in the friends REST API, allowing any authenticated attacker to enumerate another user's complete friend list. Attackers can query the friends endpoint with an arbitrary user_id because the get_items_permissions_check method only verifies that the requester is logged in and neve [truncated]
CVE-2026-53674 is a HIGH severity vulnerability in BuddyPress 14.4.0. The vulnerability exists in the activity mention resolver when username compatibility mode is enabled. Attackers can craft @mentions containing regex metacharacters, which pass through esc_sql unescaped and are inserted into an unprepared REGEXP query against the users table. This allows for boolean-based inference of usernames and deni [truncated]
CVE-2026-53673 is an insecure direct object reference vulnerability in BuddyPress 14.4.0. The vulnerability exists in the messages REST API, where an authenticated attacker can access arbitrary private message threads by supplying a user_id parameter in the request. The get_item_permissions_check method validates the supplied user_id instead of the logged-in user and is reused by the update and delete han [truncated]
