WordPress Plugin Vulnerabilities

BuddyPress < 9.1.1 - Activation Key Disclosure

Description

The plugin disclosed the activation key from responses of the create_item method in the BP REST API Signup controller.

Affects Plugins

Plugin icon
buddypress
Fixed in 9.1.1

References

URL
https://buddypress.org/2021/08/buddypress-9-1-1-security-and-maintenance-release/
URL
https://plugins.trac.wordpress.org/changeset/2584542/

Classification

Type
SENSITIVE DATA DISCLOSURE
OWASP top 10
A3: Sensitive Data Exposure
CWE
CWE-200
CVSS
5.8 (medium)

Miscellaneous

Original Researcher
Brajesh Singh
Verified
Yes
WPVDB ID
05306069-808e-4ac4-b5c1-8573817cde74

Timeline

Publicly Published
2021-08-18 (about 4 years ago)
Added
2021-08-18 (about 4 years ago)
Last Updated
2022-04-09 (about 4 years ago)

Other

Published
Title
Published
2020-06-28
Title
ACF to REST API < 3.3.0 - Unauthenticated Arbitrary wp_options Disclosure
Published
2025-04-03
Title
TailPress <= 0.4.4 - Unauthenticated Sensitive Information Exposure
Published
2024-04-16
Title
Content Control < 2.2.0 - Missing Authorization to Sensitive Information Exposure
Published
2024-08-29
Title
Masterstudy LMS Starter < 1.1.9 - Unauthenticated Sensitive Information Exposure
Published
2026-01-18
Title
Ninja Tables – Easy Data Table Builder < 5.2.6 - Authenticated (Contributor+) Information Exposure