Vulnerability · Published Jun 9, 2026 · Assigned by VulnCheck
CVE-2026-53673BuddyPress 14.4.0 Private Message IDOR via REST API user_id Parameter
High 8.1
In plain English
A high-severity authorization bypass via user-controlled key in BuddyPress from BuddyPress. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 31% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
BuddyPress 14.4.0 contains an insecure direct object reference vulnerability in the messages REST API that allows authenticated attackers to access arbitrary private message threads by supplying a user_id parameter in the request. Attackers can pass another user's identifier to the get_item_permissions_check method, which validates the supplied user_id instead of the logged-in user and is reused by the update and delete handlers, to read, reply to, or delete any user's private messages.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Packagist | buddypress/buddypress | 14.5.0 | GHSA-j3j5-5m8v-7gvc |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| BuddyPress | BuddyPress | 0 – through 14.4.0 |
Weakness: CWE-639 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N