CVE-2026-53673BuddyPress 14.4.0 Private Message IDOR via REST API user_id Parameter

Açıklama

BuddyPress 14.4.0 contains an insecure direct object reference vulnerability in the messages REST API that allows authenticated attackers to access arbitrary private message threads by supplying a user_id parameter in the request. Attackers can pass another user's identifier to the get_item_permissions_check method, which validates the supplied user_id instead of the logged-in user and is reused by the update and delete handlers, to read, reply to, or delete any user's private messages.

Veri: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Bilgiler kaynaktaki haliyle, İngilizce yayımlanır.

Etkilenen ürünler ve sürümler

Kaynaklar ve yamalar

• https://buddypress.org/ product
• https://wordpress.org/plugins/buddypress/ product
• VulnCheck Advisory: BuddyPress 14.4.0 Private Message IDOR via REST API user_id Parameter third-party-advisory