{
 "id": "WPSEC-2026-2494",
 "url": "https://wpsec.com/vuln/WPSEC-2026-2494/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-2494/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-2494/index.md",
 "title": "Wbcom Designs – BuddyPress Group Reviews <= 3.9.0 - Unauthenticated Missing Authorization to Private and Hidden Group Review Disclosure",
 "description": "The BuddyPress Group Reviews plugin for WordPress is vulnerable to unauthorized access of data via the group reviews REST API routes, the BuddyPress groups REST response, the bp_group_review_filter_ratings AJAX action, the review widgets, the schema markup and the group header rating output in all versions up to, and including, 3.9.0, due to a missing group visibility check (the review REST read routes used a permission callback that always returned true). This makes it possible for unauthenticated attackers to read reviews, ratings and review counts of private and hidden groups they are not members of.",
 "plugin": {
  "slug": "review-buddypress-groups",
  "name": "Wbcom Designs – BuddyPress Group Reviews",
  "full_name": "Wbcom Designs – BuddyPress Group Reviews",
  "wordpress_org": "https://wordpress.org/plugins/review-buddypress-groups/",
  "advisories_url": "https://wpsec.com/vuln/plugin/review-buddypress-groups/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/review-buddypress-groups"
 },
 "type": "NO AUTHORISATION",
 "cwe": [
  "CWE-862"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 5.3,
  "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
  "severity": "Medium"
 },
 "affected": {
  "ranges": [
   {
    "from": null,
    "from_inclusive": true,
    "to": "3.9.1",
    "to_inclusive": false
   }
  ],
  "text": [
   "all versions before 3.9.1"
  ]
 },
 "introduced_in": null,
 "fixed_in": "3.9.1",
 "remediation": "Update to 3.9.1 or later.",
 "fix_released": "2026-11-03T10:48:05+00:00",
 "published": "2026-11-04T14:58:24+00:00",
 "updated": "2026-11-04T14:28:38.291891+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-2494/",
  "https://plugins.svn.wordpress.org/review-buddypress-groups/tags/3.9.1/",
  "https://wordpress.org/plugins/review-buddypress-groups/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/review-buddypress-groups",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Low",
  "affected_versions": "None seen",
  "as_of": "2026-11-04"
 }
}