medium5.4
CVE-2026-8155
The BuddyPress WordPress plugin before 14.5.0 does not properly enforce authorization on its private messaging endpoints, allowing any authenticated user (Subs…
Impact
The BuddyPress WordPress plugin before 14.5.0 does not properly enforce authorization on its private messaging endpoints, allowing any authenticated user (Subscriber+) to read, modify, or delete other users' private messages.
Affected products
| Product | Affected versions |
|---|---|
| BuddyPress WordPress Plugin | before 14.5.0 |
Versions were read from the advisory text. No structured product data has been published for this record yet.