CVE-2021-21389: BuddyPress privilege escalation via REST API
Summary
CVE-2021-21389: BuddyPress privilege escalation via REST API. Affects buddypress/buddypress versions >= 5.0.0, < 7.2.1. Fixed in 7.2.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
BuddyPress is a popular WordPress plugin that adds social networking features to websites. It provides functionality for creating and managing user profiles, groups, activity streams, and more. The plugin is widely used and has a large user base. However, a vulnerability has been discovered in the BuddyPress REST API members endpoint, which allows non-privileged users to obtain administrator rights.
Vulnerability Detail
The vulnerability in the BuddyPress REST API members endpoint allows regular users to escalate their privileges and gain administrator rights. By exploiting this issue, an attacker can perform actions that are typically restricted to administrators, such as modifying user profiles, creating or deleting groups, and accessing sensitive information. This can lead to unauthorized access, data breaches, and other malicious activities. The vulnerability has a CVSS score of 8.1, indicating a high severity level.
How To Fix
Minimum fixed version
7.2.1
This is the first release that contains the fix.
composer require buddypress/buddypress:7.2.1Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is crucial to update to the latest version of BuddyPress to ensure the security of the application.
Conclusion
The BuddyPress privilege escalation vulnerability via the REST API can allow non-privileged users to obtain administrator rights, leading to unauthorized access and potential data breaches. It is crucial to update BuddyPress to version 7.2.1 or later to mitigate this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for buddypress/buddypress →
FAQ
BuddyPress is a WordPress plugin that adds social networking features to websites. It allows users to create profiles, join groups, and interact with each other.
The vulnerability allows regular users to gain administrator rights, enabling them to perform actions that are typically restricted to administrators. This can lead to unauthorized access, data breaches, and other malicious activities.
To fix this vulnerability, update BuddyPress to version 7.2.1 or later. This version includes a patch that addresses the security issue.
No, there is no known workaround for this vulnerability. It is essential to update to the latest version of BuddyPress to ensure the security of the application.
For more information, you can refer to the official BuddyPress website and the security release announcement for version 7.2.1.
Related vulnerabilities
Recent vulnerabilities recorded for buddypress/buddypress.
