CVE-2026-53673: BuddyPress 14.4.0 Private Message IDOR via REST API user_id Parameter
BuddyPress 14.4.0 contains an insecure direct object reference vulnerability in the messages REST API that allows authenticated attackers to access arbitrary private message threads by supplying a userid parameter in the request. Attackers can pass another user's identifier to the getitempermissionscheck method, which validates the supplied userid instead of the logged-in user and is reused by the update and delete handlers, to read, reply to, or delete any user's private messages.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Remove
Remove
buddypress/messagesfrom your environment.Uninstall or deactivate the BuddyPress Messages component if private messaging is not required to eliminate exposure of the vulnerable REST endpoints.
- Configuration
Disable or restrict access to the BuddyPress messages REST API endpoints (the messages component REST endpoints that accept a user_id parameter) until an official patch is available. If disabling entirely is not possible, restrict access to trusted administrators only.
BuddyPress Messages REST API REST endpoint access = disabled or restricted - Compensating control
Restrict network access to the WordPress REST API (wp-json) or the messages endpoints via firewall, WAF, or reverse-proxy rules so only trusted IPs or authenticated admin tooling can call these endpoints until a vendor fix is applied.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-53673?
The severity of CVE-2026-53673 is rated high with a CVSS score of 8.6.
How does CVE-2026-53673 affect BuddyPress users?
CVE-2026-53673 allows authenticated attackers to access arbitrary private message threads by exploiting an insecure direct object reference in the messages REST API.
Who is vulnerable to CVE-2026-53673?
User accounts in BuddyPress 14.4.0 that have been authenticated are vulnerable to CVE-2026-53673.
How do I fix CVE-2026-53673?
To resolve CVE-2026-53673, update BuddyPress to the latest version as recommended by the developers.
Is it possible for attackers to misuse CVE-2026-53673?
Yes, attackers can misuse CVE-2026-53673 to gain unauthorized access to other users' private message threads.