BuddyPress <= 14.5.2 - Authenticated (Subscriber+) Authorization Bypass to Member Type Modification via 'types' Parameter
- ID
- WPSEC-2026-1549
- Plugin
- BuddyPress (buddypress)
- Affected
- from 14.0.0 before 14.5.3
- Remediation
- Update to 14.5.3 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
- Weakness
- CWE-863
- Usage
- Plugin Medium · Affected versions Medium among sites WPSec scans, 2026-10-23
- Attack surface
- BuddyPress on WPSec AttackSurface
- Fix released
- Published
Description
The BuddyPress plugin for WordPress is vulnerable to an authorization bypass via the 'types' parameter of the members REST API endpoint in all versions up to, and including, 14.5.2, due to the update permission check only requiring the bp_moderate capability when the 'member_type' parameter is supplied, while the legacy 'types' parameter is copied into 'member_type' after the check has passed. This makes it possible for authenticated attackers, with Subscriber-level access and above, to assign any registered member type to their own account, which may give them access to features or content limited to that member type.
References
- https://wpsec.com/vuln/WPSEC-2026-1549/
- https://plugins.svn.wordpress.org/buddypress/tags/14.5.3/
- https://wordpress.org/plugins/buddypress/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS