CVE-2026-53673
HighCVSS 8.1Exploitation Probability (EPSS)
Low risk30th percentile - higher than 30% of all known CVEs
Summary
BuddyPress 14.4.0 contains an insecure direct object reference vulnerability in the messages REST API, allowing authenticated attackers to access arbitrary private message threads by supplying a user_id parameter in the request. Attackers can pass another user's identifier to the get_item_permissions_check method, which validates the supplied user_id instead of the logged-in user and is reused by update and delete handlers, to read, reply to, or delete any user's private messages.
Risk Assessment
Risk includes user privacy breach through unauthorized access to private messages, potentially leading to leakage of confidential information.
Recommendation
Immediately update BuddyPress to a version that fixes the user_id validation in the messages REST API.
Other vulnerabilities in BuddyPress
See all- CVE-2026-8155Medium
The BuddyPress WordPress plugin before version 14.5.0 does not properly enforce authorization on its private messaging endpoints, allowing any authenticated user (Subscriber+) to read, modify, or delete other users' private messages.
- CVE-2026-1360High
The BuddyPress plugin for WordPress is vulnerable to Deserialization of Untrusted Data in versions up to 14.5.0. The bp_unserialize_profile_field() function uses @unserialize() without the allowed_classes parameter on user-controlled XProfile field data.
- CVE-2026-53675Medium
BuddyPress 14.4.0 has an IDOR vulnerability in the friends REST API allowing an authenticated attacker to enumerate any user's complete friend list. The get_items_permissions_check method only checks if the requester is logged in, not ownership.
- CVE-2026-53674High
BuddyPress 14.4.0 contains a regular expression injection vulnerability in the activity mention resolver. When username compatibility mode is enabled, attackers can manipulate a REGEXP database clause by crafting mention names containing regex metacharacters. Metacharacters in @mentions pass through esc_sql unescaped and are inserted into an unprepared REGEXP query, enabling username inference and DoS through catastrophic backtracking.
Original NVD description (English source)
BuddyPress 14.4.0 contains an insecure direct object reference vulnerability in the messages REST API that allows authenticated attackers to access arbitrary private message threads by supplying a user_id parameter in the request. Attackers can pass another user's identifier to the get_item_permissions_check method, which validates the supplied user_id instead of the logged-in user and is reused by the update and delete handlers, to read, reply to, or delete any user's private messages.