CVE-2025-14064

Name of the Vulnerable Software and Affected Versions BuddyTask versions prior to 1.3.1

Description Authenticated users with Subscriber-level access and above can gain unauthorized access to and modify data due to a missing capability check on multiple AJAX endpoints. This allows attackers to view, create, modify, and delete task boards within any BuddyPress group, including private and hidden groups where they lack membership.

Recommendations Update BuddyTask to a version later than 1.3.0.