# BuddyPress <= 14.5.2 - Authenticated (Subscriber+) Authorization Bypass to Member Type Modification via 'types' Parameter

- **ID:** WPSEC-2026-1549
- **Plugin:** BuddyPress (`buddypress`), https://wordpress.org/plugins/buddypress/
- **Affected versions:** from 14.0.0 before 14.5.3
- **Fixed in:** 14.5.3 (Update to 14.5.3 or later.)
- **Severity:** Medium 4.3 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N)
- **Weakness:** CWE-863
- **Usage among sites WPSec scans:** plugin Medium, affected versions Medium (as of 2026-10-23)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/buddypress
- **Fix released:** 2026-10-22
- **Published:** 2026-10-23
- **URL:** https://wpsec.com/vuln/WPSEC-2026-1549/

## Description

The BuddyPress plugin for WordPress is vulnerable to an authorization bypass via the 'types' parameter of the members REST API endpoint in all versions up to, and including, 14.5.2, due to the update permission check only requiring the bp_moderate capability when the 'member_type' parameter is supplied, while the legacy 'types' parameter is copied into 'member_type' after the check has passed. This makes it possible for authenticated attackers, with Subscriber-level access and above, to assign any registered member type to their own account, which may give them access to features or content limited to that member type.

## References

- https://wpsec.com/vuln/WPSEC-2026-1549/
- https://plugins.svn.wordpress.org/buddypress/tags/14.5.3/
- https://wordpress.org/plugins/buddypress/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-1549/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.