WordPress Plugin Vulnerabilities

Activity Plus Reloaded for BuddyPress <= 1.1.2 - Missing Authorization

Description

The Activity Plus Reloaded for BuddyPress plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on a function in all versions up to, and including, 1.1.2. This makes it possible for authenticated attackers, with Subscriber-level access and above, to perform an unauthorized action.

Affects Plugins

Plugin icon
bp-activity-plus-reloaded
No known fix

References

CVE
CVE-2025-30957
URL
https://www.wordfence.com/threat-intel/vulnerabilities/id/3150785b-911b-44d8-aa85-afffce19c08e

Classification

Type
NO AUTHORISATION
OWASP top 10
A5: Broken Access Control
CWE
CWE-862
CVSS
4.3 (medium)

Miscellaneous

Original Researcher
domiee13
Verified
No
WPVDB ID
9aa4942e-f2a4-41e7-8919-802f7b7aa188

Timeline

Publicly Published
2025-06-05 (about 1 year ago)
Added
2025-06-10 (about 1 year ago)
Last Updated
2025-06-10 (about 1 year ago)

Other

Published
Title
Published
2024-03-29
Title
Calendarista Basic Edition < 3.0.6 - Missing Authorization
Published
2025-11-17
Title
Download Panel <= 1.3.3 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Plugin Settings Modification
Published
2025-01-30
Title
MWB HubSpot for WooCommerce – CRM, Abandoned Cart, Email Marketing, Marketing Automation & Analytics < 1.6.0 - Missing Authorization to Authenticated (Contributor+) Arbitrary Options Update
Published
2026-01-11
Title
Cream Magazine <= 2.1.10 - Missing Authorization
Published
2024-05-17
Title
Contact Form Plugin by Fluent Forms < 5.1.17 - Unauthenticated Limited Privilege Escalation