{
 "id": "WPSEC-2026-2424",
 "url": "https://wpsec.com/vuln/WPSEC-2026-2424/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-2424/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-2424/index.md",
 "title": "BuddyDrive <= 2.1.4 - Authenticated (Subscriber+) Insecure Direct Object Reference to Arbitrary File and Folder Access and Modification via Front-End Edit and Bulk Actions",
 "description": "The BuddyDrive plugin for WordPress is vulnerable to Insecure Direct Object Reference via the buddydrive_item_update and buddydrive_bulk_edit_items AJAX actions in all versions up to, and including, 2.1.4, due to a missing ownership check on the edited item and because all submitted fields, including the owner, type and file location, were passed unfiltered to the update routine. This makes it possible for authenticated attackers, with subscriber-level access and above, to modify files and folders belonging to other users, including their name, description, privacy, owner and stored file location, to take ownership of other users' private files and then download or delete them, to point their own items at other users' stored files, and to detach other users' files from folders.",
 "plugin": {
  "slug": "buddydrive",
  "name": "BuddyDrive",
  "full_name": "BuddyDrive",
  "wordpress_org": "https://wordpress.org/plugins/buddydrive/",
  "advisories_url": "https://wpsec.com/vuln/plugin/buddydrive/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/buddydrive"
 },
 "type": "IDOR",
 "cwe": [
  "CWE-639"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 8.1,
  "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
  "severity": "High"
 },
 "affected": {
  "ranges": [
   {
    "from": null,
    "from_inclusive": true,
    "to": "2.1.5",
    "to_inclusive": false
   }
  ],
  "text": [
   "all versions before 2.1.5"
  ]
 },
 "introduced_in": null,
 "fixed_in": "2.1.5",
 "remediation": "Update to 2.1.5 or later.",
 "fix_released": "2026-11-02T17:43:09+00:00",
 "published": "2026-11-03T17:48:37+00:00",
 "updated": "2026-11-03T13:41:28.251589+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-2424/",
  "https://plugins.svn.wordpress.org/buddydrive/tags/2.1.5/",
  "https://wordpress.org/plugins/buddydrive/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/buddydrive",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Low",
  "affected_versions": "None seen",
  "as_of": "2026-11-03"
 }
}