WordPress Vulnerability Scanner WPSec
Vulnerabilities / BuddyPress

BuddyPress vulnerabilities

Advisories WPSec published for BuddyPress. Other sources may list more. Its attack surface: BuddyPress on WPSec AttackSurface.

PublishedIDVulnerabilitySeverityFixed in
2026-10-23 WPSEC-2026-1558 BuddyPress <= 11.6.2 - Unauthenticated Sensitive Information Exposure of Hidden Groups via REST API Medium 5.3 11.6.3
2026-10-23 WPSEC-2026-1557 BuddyPress <= 11.6.2 - Authenticated (Subscriber+) Missing Authorization to Member Type Change via 'types' Parameter Medium 4.3 11.6.3
2026-10-23 WPSEC-2026-1556 BuddyPress <= 11.6.2 - Authenticated (Subscriber+) Missing Authorization to Activity Comment Creation via REST API Medium 4.3 11.6.3
2026-10-23 WPSEC-2026-1555 BuddyPress <= 12.7.2 - Authenticated (Subscriber+) Authorization Bypass to Member Type Modification via 'types' Parameter Medium 4.3 12.7.3
2026-10-23 WPSEC-2026-1554 BuddyPress <= 12.7.2 - Unauthenticated Sensitive Information Exposure of Hidden Groups via Groups REST API Endpoint Medium 5.3 12.7.3
2026-10-23 WPSEC-2026-1553 BuddyPress <= 12.7.2 - Authenticated (Subscriber+) Missing Authorization to Activity Comment Creation in Private and Hidden Groups via REST API Medium 4.3 12.7.3
2026-10-23 WPSEC-2026-1550 BuddyPress <= 14.5.2 - Authenticated (Subscriber+) Missing Authorization to Activity Comment Creation in Private and Hidden Groups via REST API Medium 4.3 14.5.3
2026-10-23 WPSEC-2026-1549 BuddyPress <= 14.5.2 - Authenticated (Subscriber+) Authorization Bypass to Member Type Modification via 'types' Parameter Medium 4.3 14.5.3
2026-10-23 WPSEC-2026-1548 BuddyPress <= 14.5.2 - Unauthenticated Sensitive Information Exposure of Hidden Groups via Groups REST API Endpoint Medium 5.3 14.5.3

License: CC BY 4.0