The BuddyPress plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 14.3.3 via the bp_notifications_action_bulk_manage due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with Subscriber-level access and above, to delete/mark as read/mark as unread notifications of other users.
Datos: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Se publican tal como los indican las fuentes, en inglés.
| Fabricante | Producto | Versiones | |
|---|---|---|---|
| buddypress | BuddyPress | ≤ 14.3.3 |
Dos herramientas gratuitas, una sola defensa: el Sensor detecta a quien sondea su servidor; Shield detiene a los atacantes conocidos antes de que lleguen a su sitio.
Instálelo y su cuota diaria de API sube a 30.000 consultas, sin solicitudes.
