CVE-2025-30957: WordPress Activity Plus Reloaded for BuddyPress plugin <= 1.1.2 - Broken Access Control Vulnerability
Missing Authorization vulnerability in BuddyDev Activity Plus Reloaded for BuddyPress allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Activity Plus Reloaded for BuddyPress: from n/a through 1.1.2.
Other sources
Missing Authorization vulnerability in BuddyDev Activity Plus Reloaded for BuddyPress bp-activity-plus-reloaded allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Activity Plus Reloaded for BuddyPress: from n/a through <= 1.1.2.
— MITRE
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-30957?
CVE-2025-30957 is classified as a medium severity vulnerability due to missing authorization in the BuddyDev Activity Plus Reloaded for BuddyPress.
How do I fix CVE-2025-30957?
To address CVE-2025-30957, update BuddyDev Activity Plus Reloaded for BuddyPress to version 1.1.3 or higher immediately.
What kind of impact can CVE-2025-30957 have on my website?
Exploiting CVE-2025-30957 can allow unauthorized users to access restricted features, potentially leading to data leaks or other security issues.
Who is affected by CVE-2025-30957?
CVE-2025-30957 affects users of BuddyDev Activity Plus Reloaded for BuddyPress versions up to 1.1.2.
Is CVE-2025-30957 being actively exploited?
As of now, there is no public indication of active exploitation for CVE-2025-30957, but it is recommended to patch the vulnerability promptly.