# BuddyPress <= 12.7.2 - Authenticated (Subscriber+) Missing Authorization to Activity Comment Creation in Private and Hidden Groups via REST API

- **ID:** WPSEC-2026-1553
- **Plugin:** BuddyPress (`buddypress`), https://wordpress.org/plugins/buddypress/
- **Affected versions:** from 12.0.0 before 12.7.3
- **Fixed in:** 12.7.3 (Update to 12.7.3 or later.)
- **Severity:** Medium 4.3 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N)
- **Weakness:** CWE-862
- **Usage among sites WPSec scans:** plugin Medium, affected versions Low (as of 2026-10-23)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/buddypress
- **Fix released:** 2026-10-22
- **Published:** 2026-10-23
- **URL:** https://wpsec.com/vuln/WPSEC-2026-1553/

## Description

The BuddyPress plugin for WordPress is vulnerable to unauthorized activity comment creation via the activity REST API endpoint in all versions up to, and including, 12.7.2, due to a missing authorization check on the target activity when the 'activity_comment' type is used. The plugin does not check whether the user may comment on the activity, including activity in private or hidden groups the user does not belong to, and does not check that the parent comment belongs to that activity. This makes it possible for authenticated attackers, with Subscriber-level access and above, to post comments on activity items they should not be able to interact with.

## References

- https://wpsec.com/vuln/WPSEC-2026-1553/
- https://plugins.svn.wordpress.org/buddypress/tags/12.7.3/
- https://wordpress.org/plugins/buddypress/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-1553/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.