CVE-2026-53673: BuddyPress Arbitrary Private Message Access Vulnerability
Summary
CVE-2026-53673: BuddyPress 14.4.0 contains an insecure direct object reference vulnerability in the messages REST API that allows authenticated attackers to access arbitrary private message threads by supplying a user_id parameter in th... Affects buddypress/buddypress versions < 14.5.0. Fixed in 14.5.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
BuddyPress is a popular open-source plugin for WordPress that facilitates social networking features, allowing users to create profiles, connect with friends, and send private messages. It is widely used in community-driven websites to enhance user interaction. However, version 14.4.0 of BuddyPress contains a critical vulnerability in its messages REST API, which can lead to unauthorized access to private messages.
Vulnerability Detail
The vulnerability arises from an insecure direct object reference in the messages REST API of BuddyPress. Authenticated attackers can exploit this flaw by manipulating the user_id request parameter to access private message threads belonging to other users. This occurs because the get_item_permissions_check method incorrectly validates the supplied user_id instead of the logged-in user's ID. As a result, attackers can read, reply to, or delete any user's private messages, leading to severe privacy breaches and potential data loss.
How To Fix
Minimum fixed version
14.5.0
This is the first release that contains the fix.
composer require buddypress/buddypress:14.5.0Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, restrict access to the messages REST API for authenticated users until the package is updated. This can be done by modifying the API permissions in your WordPress setup.
Conclusion
The vulnerability identified as CVE-2026-53673 in BuddyPress allows authenticated attackers to access arbitrary private message threads, posing a significant risk to user privacy. It is crucial for users to update to the patched version 14.5.0 or later to safeguard against this issue. Utilizing tools like Vulert can help in monitoring for such vulnerabilities in real-time.
See every vulnerability recorded for buddypress/buddypress →
FAQ
The CVSS score of this vulnerability is 8.1, indicating a high severity level.
You can use Vulert to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected without requiring any signup.
If exploited, this vulnerability can lead to unauthorized access to private messages, resulting in privacy violations and potential data breaches.
Yes, a patch is available in BuddyPress version 14.5.0 and later. It is recommended to update to this version to mitigate the risk.
If you cannot update immediately, consider implementing access restrictions to the messages REST API as a temporary workaround.
Related vulnerabilities
Recent vulnerabilities recorded for buddypress/buddypress.
