{
 "id": "WPSEC-2026-1548",
 "url": "https://wpsec.com/vuln/WPSEC-2026-1548/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-1548/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-1548/index.md",
 "title": "BuddyPress <= 14.5.2 - Unauthenticated Sensitive Information Exposure of Hidden Groups via Groups REST API Endpoint",
 "description": "The BuddyPress plugin for WordPress is vulnerable to Sensitive Information Exposure via the 'status' parameter of the groups REST API endpoint in all versions up to, and including, 14.5.2, due to the hidden-group restriction only being enforced when the 'show_hidden' parameter is requested, while a request filtering by status removes the default exclusion of hidden groups. This makes it possible for unauthenticated attackers to list hidden groups and their details, which should only be visible to their members and site moderators.",
 "plugin": {
  "slug": "buddypress",
  "name": "BuddyPress",
  "full_name": "BuddyPress",
  "wordpress_org": "https://wordpress.org/plugins/buddypress/",
  "advisories_url": "https://wpsec.com/vuln/plugin/buddypress/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/buddypress"
 },
 "type": "SENSITIVE DATA DISCLOSURE",
 "cwe": [
  "CWE-200"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 5.3,
  "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
  "severity": "Medium"
 },
 "affected": {
  "ranges": [
   {
    "from": "14.0.0",
    "from_inclusive": true,
    "to": "14.5.3",
    "to_inclusive": false
   }
  ],
  "text": [
   "from 14.0.0 before 14.5.3"
  ]
 },
 "introduced_in": "14.0.0",
 "fixed_in": "14.5.3",
 "remediation": "Update to 14.5.3 or later.",
 "fix_released": "2026-10-22T18:05:41+00:00",
 "published": "2026-10-23T18:43:09+00:00",
 "updated": "2026-10-23T09:48:29.177880+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-1548/",
  "https://plugins.svn.wordpress.org/buddypress/tags/14.5.3/",
  "https://wordpress.org/plugins/buddypress/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/buddypress",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Medium",
  "affected_versions": "Medium",
  "as_of": "2026-10-23"
 }
}