BuddyPress <= 7.2.1 - Insufficient Privilege De-escalation
2021-04-14 00:00
Kien HoangStrategic Overview
Vulnerability Overview
The BuddyPress plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on the can_user_delete_or_update( ) function from versions starting at 7.0.0 to 7.2.1. This makes it possible for recently demoted user to modify groups in which they were the original creator.
Technical Analysis
REMEDIATION: Update to version 7.3.0, or a newer patched version --- IDENTIFIER: CWE-284 (Improper Access Control) The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.
External References
Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C