CVE-2024-12145: BuddyPress <= 14.3.3 - Insecure Direct Object Reference to Notifications Deletion
The BuddyPress plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 14.3.3 via the bpnotificationsactionbulkmanage due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with Subscriber-level access and above, to delete/mark as read/mark as unread notifications of other users.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
BuddyPress (WordPress plugin)to a version that resolves this vulnerability.Fixed in 14.3.3 - Compensating control
Restrict access to the BuddyPress bulk notifications action endpoint (bp_notifications_action_bulk_manage) so only users allowed to manage their own notifications can invoke it, preventing subscribers from deleting/marking as read/unread notifications for other users.
Event History
Frequently Asked Questions
Who can exploit this issue?
An authenticated WordPress user with Subscriber-level access or higher can exploit it. The attacker must be able to use BuddyPress notification bulk-management functionality.
What could an attacker do?
An attacker could delete another user's notifications or change them to read or unread. The issue affects notification state and availability, not confidentiality.
Which installations are affected?
BuddyPress versions up to and including 14.3.3 are affected. The provided information does not identify configuration-based prerequisites or a mitigation other than updating beyond the affected versions.