BuddyPress <= 14.5.2 - Authenticated (Subscriber+) Missing Authorization to Activity Comment Creation in Private and Hidden Groups via REST API
- ID
- WPSEC-2026-1550
- Plugin
- BuddyPress (buddypress)
- Affected
- from 14.0.0 before 14.5.3
- Remediation
- Update to 14.5.3 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
- Weakness
- CWE-862
- Usage
- Plugin Medium · Affected versions Medium among sites WPSec scans, 2026-10-23
- Attack surface
- BuddyPress on WPSec AttackSurface
- Fix released
- Published
Description
The BuddyPress plugin for WordPress is vulnerable to unauthorized activity comment creation via the activity REST API endpoint in all versions up to, and including, 14.5.2, due to a missing authorization check on the target activity when the 'activity_comment' type is used. The plugin does not check whether the user may comment on the activity, including activity in private or hidden groups the user does not belong to, and does not check that the parent comment belongs to that activity. This makes it possible for authenticated attackers, with Subscriber-level access and above, to post comments on activity items they should not be able to interact with.
References
- https://wpsec.com/vuln/WPSEC-2026-1550/
- https://plugins.svn.wordpress.org/buddypress/tags/14.5.3/
- https://wordpress.org/plugins/buddypress/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS