WordPress Plugin Vulnerabilities

BuddyPress < 14.3.4 - Insecure Direct Object Reference to Notifications Deletion

Description

The BuddyPress plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 14.3.3 via the bp_notifications_action_bulk_manage due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with Subscriber-level access and above, to delete/mark as read/mark as unread notifications of other users.

Affects Plugins

Plugin icon
buddypress
Fixed in 14.3.4

References

CVE
CVE-2024-12145
URL
https://www.wordfence.com/threat-intel/vulnerabilities/id/8c2965c0-a07f-46a2-b06c-fa2e739aea94

Classification

Type
NO AUTHORISATION
OWASP top 10
A5: Broken Access Control
CWE
CWE-862
CVSS
4.3 (medium)

Miscellaneous

Original Researcher
Brian Mungai
Verified
No
WPVDB ID
09bd0313-39a8-4810-b5b2-1f1c4db77a1a

Timeline

Publicly Published
2026-09-10 (about 1 month ago)
Added
2026-09-10 (about 1 month ago)
Last Updated
2026-09-11 (about 1 month ago)

Other

Published
Title
Published
2024-11-20
Title
Ultimate YouTube Video & Shorts Player With Vimeo <= 3.3 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Playlist/Video Deletion
Published
2024-11-22
Title
WP Travel Engine < 6.2.2 - Missing Authorization to Authenticated (Contributor+) Plugin Settings Update
Published
2025-12-05
Title
Custom Layouts – Post + Product grids made easy < 1.5.0 - Missing Authorization
Published
2026-01-07
Title
Folders – Unlimited Folders to Organize Media Library Folder, Pages, Posts, File Manager < 3.1.6 - Missing Authorization to Authenticated (Author+) Media Replacement
Published
2026-08-07
Title
WP Social Avatar <= 1.5 - Missing Authorization