BuddyDrive <= 2.1.4 - Authenticated (Subscriber+) Insecure Direct Object Reference to Arbitrary File and Folder Access and Modification via Front-End Edit and Bulk Actions
- ID
- WPSEC-2026-2424
- Plugin
- BuddyDrive (buddydrive)
- Affected
- all versions before 2.1.5
- Remediation
- Update to 2.1.5 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
- Weakness
- CWE-639
- Usage
- Plugin Low · Affected versions None seen among sites WPSec scans, 2026-11-03
- Attack surface
- BuddyDrive on WPSec AttackSurface
- Fix released
- Published
Description
The BuddyDrive plugin for WordPress is vulnerable to Insecure Direct Object Reference via the buddydrive_item_update and buddydrive_bulk_edit_items AJAX actions in all versions up to, and including, 2.1.4, due to a missing ownership check on the edited item and because all submitted fields, including the owner, type and file location, were passed unfiltered to the update routine. This makes it possible for authenticated attackers, with subscriber-level access and above, to modify files and folders belonging to other users, including their name, description, privacy, owner and stored file location, to take ownership of other users' private files and then download or delete them, to point their own items at other users' stored files, and to detach other users' files from folders.
References
- https://wpsec.com/vuln/WPSEC-2026-2424/
- https://plugins.svn.wordpress.org/buddydrive/tags/2.1.5/
- https://wordpress.org/plugins/buddydrive/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS