CVE-2026-53673 json
BuddyPress 14.4.0 Private Message IDOR via REST API user_id Parameter
published 5mo ago modified last mo. also EUVD-2026-35877 , GHSA-j3j5-5m8v-7gvc
- cvss
- 8.1
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.4%
- EPSS 0.4% chance of exploitation in 30 days, percentile 31%
- public exploits
- 0
- none known
Summary
BuddyPress 14.4.0 contains an insecure direct object reference vulnerability in the messages REST API that allows authenticated attackers to access arbitrary private message threads by supplying a user_id parameter in the request. Attackers can pass another user's identifier to the get_item_permissions_check method, which validates the supplied user_id instead of the logged-in user and is reused by the update and delete handlers, to read, reply to, or delete any user's private messages.
Patch / fix
Is CVE-2026-53673 in your dependencies? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.
Check with FencerCISA SSVC
- Exploitation
- none
- Automatable
- no
- Technical impact
- total
- Assessed
- 5mo ago
Exploit prediction
0.37% chance of exploitation in the next 30 days, higher than 31% of all scored CVEs (FIRST EPSS, 2026-11-11).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 4.0 | 8.6 | CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N |
| CNA | 3.1 | 8.1 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N |
| GitHub | 3.1 | 8.1 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N |
| CNA | 4.0 | 8.6 | CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| packagist | buddypress/buddypress | <14.5.0 |
14.5.0 |
Affected products
- BuddyPress BuddyPress
Classification
- Weakness
-
- CWE-639 Authorization Bypass Through User-Controlled Key
- Technology feeds
References
-
github.com
/buddypress/buddypress/commit/27d41e9749a878103b3a673b37dfc92b7f8f2cb7
web
-
buddypress.org
/
product
-
wordpress.org
/plugins/buddypress/
product
-
vulncheck.com
/advisories/buddypress-private-message-idor-via-rest-api-user-id-parameter
third-party-advisory, web
-
nvd.nist.gov
/vuln/detail/CVE-2026-53673
advisory
-
buddypress.org
web
-
github.com
/buddypress/BuddyPress
package
-
wordpress.org
/plugins/buddypress
web
Sources
- CVE List CVE-2026-53673
- GitHub Advisory GHSA-j3j5-5m8v-7gvc
- NVD CVE-2026-53673
Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.
CPEs and fixed versions use Anchore's correction of NVD's data: Added CPE configurations because not yet analyzed by NVD.