CVE-2026-53673
HighCVSS 8.1Exploitation Probability (EPSS)
Low risk6th percentile - higher than 6% of all known CVEs
Summary
BuddyPress version 14.4.0 contains an insecure direct object reference vulnerability in the messages REST API that allows authenticated attackers to access arbitrary private message threads.
Risk Assessment
Attackers can access other users' private messages, leading to privacy and data confidentiality breaches.
Recommendation
It is recommended to update BuddyPress to the latest version to mitigate this vulnerability and implement additional access control mechanisms.
Original NVD description (English source)
BuddyPress 14.4.0 contains an insecure direct object reference vulnerability in the messages REST API that allows authenticated attackers to access arbitrary private message threads by supplying a user_id parameter in the request. Attackers can pass another user's identifier to the get_item_permissions_check method, which validates the supplied user_id instead of the logged-in user and is reused by the update and delete handlers, to read, reply to, or delete any user's private messages.