CVE-2026-53673: BuddyPress 14.4.0 Private Message IDOR via REST API user_id Parameter
BuddyPress 14.4.0 contains an insecure direct object reference vulnerability in the messages REST API that allows authenticated attackers to access arbitrary private message threads by supplying a userid parameter in the request. Attackers can pass another user's identifier to the getitempermissionscheck method, which validates the supplied userid instead of the logged-in user and is reused by the update and delete handlers, to read, reply to, or delete any user's private messages.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-53673?
The severity of CVE-2026-53673 is rated high with a CVSS score of 8.6.
How does CVE-2026-53673 affect BuddyPress users?
CVE-2026-53673 allows authenticated attackers to access arbitrary private message threads by exploiting an insecure direct object reference in the messages REST API.
Who is vulnerable to CVE-2026-53673?
User accounts in BuddyPress 14.4.0 that have been authenticated are vulnerable to CVE-2026-53673.
How do I fix CVE-2026-53673?
To resolve CVE-2026-53673, update BuddyPress to the latest version as recommended by the developers.
Is it possible for attackers to misuse CVE-2026-53673?
Yes, attackers can misuse CVE-2026-53673 to gain unauthorized access to other users' private message threads.