5.4
Moyenne
CVE-2026-8155 The BuddyPress WordPress plugin before 14.5.0 does not properly enforce authorization on its private messaging…
Description
The BuddyPress WordPress plugin before 14.5.0 does not properly enforce authorization on its private messaging endpoints, allowing any authenticated user (Subscriber+) to read, modify, or delete other users' private messages.
Produits et versions touchés
| Produit | Versions touchées | Corrigé en |
|---|---|---|
| BuddyPress 14.5 | premières → < 14.5.0 | 14.5.0 |