Restrictions for BuddyPress
Restrictions for BuddyPress has one disclosed vulnerability in the WordSec catalog, all reported in 2025; it is fixed as of September 2026. Their average CVSS score is 5.3, and the most serious one scores 5.3 out of 10.
The most common weakness is Missing Authorization, behind 1 of the records (100%).
The one issue recorded for Restrictions for BuddyPress has a vendor fix available, so running the current release closes it.
All of these findings were reported by Legion Hunter. Restrictions for BuddyPress is installed on roughly 300 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 7.0.4.
CVE-2025-12391Restrictions for BuddyPress <= 1.5.2 - Missing Authorization to Unauthenticated Tracking Status Update
Read the full analysisVulnerability Records

Restrictions for BuddyPress
Author
SeventhQueen
Restrictions for BuddyPress gives you full control over who can see and access your BuddyPress community pages. Hide profiles, groups, activity, and messages from visitors, non-members, or specific membership levels. Perfect for membership sites, private communities, paid networks, and gated BuddyPress installations. What You Can Restrict Members Directory — Hide the full members list from visitors or non-members Member Profiles — Control who can view individual BuddyPress profiles Groups Directory — Restrict access to the groups listing page Single Group Pages — Lock individual group pages behind membership Site-Wide Activity — Hide the activity stream from unauthorized users Private Messages — Restrict messaging to specific membership levels Membership Integration Seamlessly integrates with Paid Memberships Pro (PMPro): Apply restrictions based on your existing membership levels Show upgrade prompts to non-members trying to access restricted content Mix and match — some areas free, some members-only Free Access by Profile Field Grant free access to specific BuddyPress members based on a profile field value — no membership plugin required. Ideal for: Giving VIP access to users with a specific role or profile attribute Creating tiered access without a full membership setup Whitelisting beta testers or early adopters BuddyBoss Compatible Fully compatible with BuddyBoss Platform, so your restrictions work whether you’re running classic BuddyPress or BuddyBoss. How It Works Install and activate the plugin Go to Settings → BP Restrict Choose which BuddyPress areas to restrict Select restriction type: visitors, all non-members, or specific membership levels Set a custom redirect URL or restriction message Done — your community is protected Use Cases Private communities — Only logged-in members can browse profiles and groups Paid membership sites — Gate BuddyPress features behind PMPro membership levels Corporate intranets — Restrict the social layer to employees only Online courses — Let students access the community, hide it from everyone else Dating sites — Require membership to view profiles or send messages
Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C