5.4
Medium
CVE-2026-8155 The BuddyPress WordPress plugin before 14.5.0 does not properly enforce authorization on its private messaging…
Description
The BuddyPress WordPress plugin before 14.5.0 does not properly enforce authorization on its private messaging endpoints, allowing any authenticated user (Subscriber+) to read, modify, or delete other users' private messages.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| BuddyPress 14.5 | earliest → < 14.5.0 | 14.5.0 |