Vulnerabilities / BuddyPress / WPSEC-2026-1558
BuddyPress <= 11.6.2 - Unauthenticated Sensitive Information Exposure of Hidden Groups via REST API
Medium 5.3
CWE-200Fixed in 11.6.3
- ID
- WPSEC-2026-1558
- Plugin
- BuddyPress (buddypress)
- Affected
- all versions before 11.6.3
- Remediation
- Update to 11.6.3 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
- Weakness
- CWE-200
- Usage
- Plugin Medium · Affected versions Medium among sites WPSec scans, 2026-10-23
- Attack surface
- BuddyPress on WPSec AttackSurface
- Fix released
- Published
Description
The BuddyPress plugin for WordPress is vulnerable to Sensitive Information Exposure via the groups REST API endpoint in all versions up to, and including, 11.6.2 due to the hidden-group exclusion only being enforced when the 'show_hidden' parameter was explicitly requested. This makes it possible for unauthenticated attackers to list hidden groups and their details, for example by supplying a status parameter in the request.
References
- https://wpsec.com/vuln/WPSEC-2026-1558/
- https://plugins.svn.wordpress.org/buddypress/tags/11.6.3/
- https://wordpress.org/plugins/buddypress/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS