Vulnerabilities / Wbcom Designs – BuddyPress Group Reviews / WPSEC-2026-2494
Wbcom Designs – BuddyPress Group Reviews <= 3.9.0 - Unauthenticated Missing Authorization to Private and Hidden Group Review Disclosure
Medium 5.3
CWE-862Fixed in 3.9.1
- ID
- WPSEC-2026-2494
- Plugin
- Wbcom Designs – BuddyPress Group Reviews (review-buddypress-groups)
- Affected
- all versions before 3.9.1
- Remediation
- Update to 3.9.1 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
- Weakness
- CWE-862
- Usage
- Plugin Low · Affected versions None seen among sites WPSec scans, 2026-11-04
- Attack surface
- Wbcom Designs – BuddyPress Group Reviews on WPSec AttackSurface
- Fix released
- Published
Description
The BuddyPress Group Reviews plugin for WordPress is vulnerable to unauthorized access of data via the group reviews REST API routes, the BuddyPress groups REST response, the bp_group_review_filter_ratings AJAX action, the review widgets, the schema markup and the group header rating output in all versions up to, and including, 3.9.0, due to a missing group visibility check (the review REST read routes used a permission callback that always returned true). This makes it possible for unauthenticated attackers to read reviews, ratings and review counts of private and hidden groups they are not members of.
References
- https://wpsec.com/vuln/WPSEC-2026-2494/
- https://plugins.svn.wordpress.org/review-buddypress-groups/tags/3.9.1/
- https://wordpress.org/plugins/review-buddypress-groups/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS