PT-2026-89863 · Buddypress+1 · Buddypress
CVSS v3.1
4.3
متوسطة
| المتجه | AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N |
Name of the Vulnerable Software and Affected Versions
BuddyPress versions prior to 14.3.4
Description
An Insecure Direct Object Reference (IDOR) exists in the BuddyPress plugin for WordPress. This issue occurs within the
bp notifications action bulk manage function due to missing validation on a user-controlled key. Authenticated attackers with Subscriber-level access or higher can exploit this to delete, mark as read, or mark as unread notifications belonging to other users.Recommendations
Update BuddyPress to version 14.3.4 or later.
إصلاح
Missing Authorization
وجدت خطأً في الوصف؟ لديك ما تضيفه؟ لا تتردد في مراسلتنا 👾
تصنيف نقاط الضعف
المعرّفات ذات الصلة
المنتجات المتأثرة
Buddypress