CVE-2026-8155 — BuddyPress < 14.5.0 - Subscriber+ Private Messages Disclosure via IDOR
The BuddyPress WordPress plugin before 14.5.0 does not properly enforce authorization on its private messaging endpoints, allowing any authenticated user (Subscriber+) to read, …
Published: 2026-07-31 · CVSS: 5.4 · CVSS 3.1
The BuddyPress WordPress plugin before 14.5.0 does not properly enforce authorization on its private messaging endpoints, allowing any authenticated user (Subscriber+) to read, modify, or delete other users' private messages.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7