CVE-2026-8155
MediumCVSS 5.4Exploitation Probability (EPSS)
Low risk3th percentile - higher than 3% of all known CVEs
Summary
The BuddyPress WordPress plugin before version 14.5.0 does not properly enforce authorization on its private messaging endpoints, allowing any authenticated user (Subscriber+) to read, modify, or delete other users' private messages.
Risk Assessment
The risk is a breach of user privacy and data integrity, as an attacker can read, modify, or delete other users' private messages.
Recommendation
Update the BuddyPress plugin to version 14.5.0 or later.
Other vulnerabilities in BuddyPress
See all- CVE-2026-1360High
The BuddyPress plugin for WordPress is vulnerable to Deserialization of Untrusted Data in versions up to 14.5.0. The bp_unserialize_profile_field() function uses @unserialize() without the allowed_classes parameter on user-controlled XProfile field data.
- CVE-2026-53675Medium
BuddyPress 14.4.0 has an IDOR vulnerability in the friends REST API allowing an authenticated attacker to enumerate any user's complete friend list. The get_items_permissions_check method only checks if the requester is logged in, not ownership.
- CVE-2026-53674High
BuddyPress 14.4.0 contains a regular expression injection vulnerability in the activity mention resolver. When username compatibility mode is enabled, attackers can manipulate a REGEXP database clause by crafting mention names containing regex metacharacters. Metacharacters in @mentions pass through esc_sql unescaped and are inserted into an unprepared REGEXP query, enabling username inference and DoS through catastrophic backtracking.
- CVE-2026-53673High
BuddyPress 14.4.0 contains an insecure direct object reference vulnerability in the messages REST API, allowing authenticated attackers to access arbitrary private message threads by supplying a user_id parameter in the request. Attackers can pass another user's identifier to the get_item_permissions_check method, which validates the supplied user_id instead of the logged-in user and is reused by update and delete handlers, to read, reply to, or delete any user's private messages.
Original NVD description (English source)
The BuddyPress WordPress plugin before 14.5.0 does not properly enforce authorization on its private messaging endpoints, allowing any authenticated user (Subscriber+) to read, modify, or delete other users' private messages.