CVE-2025-1909: BuddyBoss Platform Pro <= 2.7.01 - Authentication Bypass via Apple OAuth provider
The BuddyBoss Platform Pro plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 2.7.01. This is due to insufficient verification on the user being supplied during the Apple OAuth authenticate request through the plugin. This makes it possible for unauthenticated attackers to log in as any existing user on the site, such as an administrator, if they have access to the email.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-1909?
CVE-2025-1909 is classified as a high-severity vulnerability due to its potential for authentication bypass.
How do I fix CVE-2025-1909?
To resolve CVE-2025-1909, update the BuddyBoss Platform Pro plugin to version 2.7.10 or higher.
Which versions are affected by CVE-2025-1909?
CVE-2025-1909 affects all versions of BuddyBoss Platform Pro up to and including 2.7.01.
What causes CVE-2025-1909?
The vulnerability in CVE-2025-1909 is caused by insufficient verification on the user during the Apple OAuth authentication request.
Can CVE-2025-1909 lead to unauthorized access?
Yes, CVE-2025-1909 can allow attackers to bypass authentication and gain unauthorized access to user accounts.