{
 "id": "WPSEC-2026-1549",
 "url": "https://wpsec.com/vuln/WPSEC-2026-1549/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-1549/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-1549/index.md",
 "title": "BuddyPress <= 14.5.2 - Authenticated (Subscriber+) Authorization Bypass to Member Type Modification via 'types' Parameter",
 "description": "The BuddyPress plugin for WordPress is vulnerable to an authorization bypass via the 'types' parameter of the members REST API endpoint in all versions up to, and including, 14.5.2, due to the update permission check only requiring the bp_moderate capability when the 'member_type' parameter is supplied, while the legacy 'types' parameter is copied into 'member_type' after the check has passed. This makes it possible for authenticated attackers, with Subscriber-level access and above, to assign any registered member type to their own account, which may give them access to features or content limited to that member type.",
 "plugin": {
  "slug": "buddypress",
  "name": "BuddyPress",
  "full_name": "BuddyPress",
  "wordpress_org": "https://wordpress.org/plugins/buddypress/",
  "advisories_url": "https://wpsec.com/vuln/plugin/buddypress/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/buddypress"
 },
 "type": "BYPASS",
 "cwe": [
  "CWE-863"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 4.3,
  "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
  "severity": "Medium"
 },
 "affected": {
  "ranges": [
   {
    "from": "14.0.0",
    "from_inclusive": true,
    "to": "14.5.3",
    "to_inclusive": false
   }
  ],
  "text": [
   "from 14.0.0 before 14.5.3"
  ]
 },
 "introduced_in": "14.0.0",
 "fixed_in": "14.5.3",
 "remediation": "Update to 14.5.3 or later.",
 "fix_released": "2026-10-22T18:05:41+00:00",
 "published": "2026-10-23T18:43:09+00:00",
 "updated": "2026-10-23T09:48:29.177880+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-1549/",
  "https://plugins.svn.wordpress.org/buddypress/tags/14.5.3/",
  "https://wordpress.org/plugins/buddypress/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/buddypress",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Medium",
  "affected_versions": "Medium",
  "as_of": "2026-10-23"
 }
}