CVE-2025-12391: Restrictions for BuddyPress <= 1.5.2 - Missing Authorization to Unauthenticated Tracking Status Update
The Restrictions for BuddyPress plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the handleoptinoptout() function in all versions up to, and including, 1.5.2. This makes it possible for unauthenticated attackers to opt in and out of tracking.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-12391?
CVE-2025-12391 has a medium severity rating due to the potential for unauthorized data modification by unauthenticated attackers.
How do I fix CVE-2025-12391?
To fix CVE-2025-12391, update the BuddyPress plugin to the latest version that includes a proper capability check.
What versions of BuddyPress are affected by CVE-2025-12391?
CVE-2025-12391 affects all versions of BuddyPress up to and including version 1.5.2.
What is the impact of CVE-2025-12391?
The impact of CVE-2025-12391 allows unauthenticated users to opt in or opt out of settings, leading to unauthorized data modification.
Is it safe to use BuddyPress versions above 1.5.2 after fixing CVE-2025-12391?
Yes, using BuddyPress versions above 1.5.2 is safe as they have addressed the vulnerability.