CVE-2026-53675: BuddyPress Friend List Enumeration via IDOR Vulnerability
Summary
CVE-2026-53675: BuddyPress: Any authenticated attacker can enumerate another user's complete friend list via IDOR. Affects buddypress/buddypress versions < 14.4.0. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
BuddyPress is a popular open-source social networking plugin for WordPress that enables users to create and manage their own social networks. It provides features such as user profiles, activity streams, and friend connections. However, version 14.4.0 of BuddyPress has been found to contain a vulnerability that allows authenticated users to access the friend lists of other users without proper authorization checks.
Vulnerability Detail
The vulnerability arises from an insecure direct object reference (IDOR) in the friends REST API of BuddyPress 14.4.0. The get_items_permissions_check method only verifies if the requester is logged in, failing to check whether the requester is the owner of the requested friend list. This oversight allows any authenticated attacker to enumerate another user's complete friend list, potentially exposing private social connections and leading to privacy breaches.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, you can restrict access to the friends REST API by implementing custom permission checks in your BuddyPress installation. This would involve modifying the API endpoint to ensure that only the owner of the friend list can access it.
Conclusion
The CVE-2026-53675 vulnerability in BuddyPress poses a significant risk by allowing authenticated users to access other users' friend lists. It is crucial for users to update to the latest version of BuddyPress to mitigate this risk and protect user privacy.
See every vulnerability recorded for buddypress/buddypress →
FAQ
CVE-2026-53675 is a vulnerability in BuddyPress that allows authenticated users to enumerate another user's friend list due to improper authorization checks.
This vulnerability can lead to unauthorized access to private friend lists, compromising user privacy and security.
BuddyPress version 14.4.0 is affected by this vulnerability. Users should update to a version higher than 14.4.0.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
Vulert is a service that monitors and alerts users in real-time for open-source vulnerabilities in software by analyzing the composer.lock file.
Related vulnerabilities
Recent vulnerabilities recorded for buddypress/buddypress.
