# BuddyPress Member Reviews <= 3.8.0 - Authenticated (Subscriber+) Missing Authorization to Moderation Bypass via Review Update

- **ID:** WPSEC-2026-0751
- **Plugin:** Wbcom Designs – BuddyPress Member Reviews (`bp-user-profile-reviews`), https://wordpress.org/plugins/bp-user-profile-reviews/
- **Affected versions:** all versions before 3.8.1
- **Fixed in:** 3.8.1 (Update to 3.8.1 or later.)
- **Severity:** Medium 4.3 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N)
- **Weakness:** CWE-862
- **Usage among sites WPSec scans:** plugin Low, affected versions None seen (as of 2026-10-10)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/bp-user-profile-reviews
- **Fix released:** 2026-10-09
- **Published:** 2026-10-10
- **URL:** https://wpsec.com/vuln/WPSEC-2026-0751/

## Description

The BuddyPress Member Reviews plugin for WordPress is vulnerable to a moderation bypass in all versions up to, and including, 3.8.0 due to the review update handler forcing the review's status to 'publish' on every edit and the Update Review setting only being enforced by hiding the Edit button. This makes it possible for authenticated attackers who wrote a review to edit a pending or report-hidden review and have it published immediately without moderator approval.

## References

- https://wpsec.com/vuln/WPSEC-2026-0751/
- https://plugins.svn.wordpress.org/bp-user-profile-reviews/tags/3.8.1/
- https://wordpress.org/plugins/bp-user-profile-reviews/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-0751/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.