CVE-2026-53673

Name of the Vulnerable Software and Affected Versions BuddyPress version 14.4.0

Description An insecure direct object reference exists in the messages REST API. Authenticated attackers can access arbitrary private message threads by supplying a user id parameter in the request. The get item permissions check() function validates the supplied user id instead of the logged-in user. This function is reused by the update and delete handlers, allowing attackers to read, reply to, or delete any user's private messages.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.