Description

WordPress Plugin BuddyPress is prone to multiple security bypass vulnerabilities. Exploiting these issues may allow attackers to perform otherwise restricted actions and subsequently create groups on behalf of another members, to favorite any private/hidden activities, or more. WordPress Plugin BuddyPress version 7.2.1 is vulnerable; prior versions may also be affected.

Remediation

Update to plugin version 7.3.0 or latest

References

https://codex.buddypress.org/releases/version-7-3-0/

Related Vulnerabilities

WordPress Plugin Blog2Social:Social Media Auto Post & Scheduler SQL Injection (6.3.0)

Omeka Server-Side Request Forgery (SSRF) Vulnerability (CVE-2023-3981)

Atlassian Confluence Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2017-18083)

WordPress Plugin Ultimate Member-User Profile, Registration, Login, Member Directory, Content Restriction & Membership Cross-Site Request Forgery (2.0.39)

Joomla! Core 3.x.x Security Bypass (3.2.0 - 3.9.24)

Severity

High

Classification

CWE-264 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Tags

Missing Update Authentication Bypass