CVE-2026-53675: BuddyPress 14.4.0 Friends List IDOR via REST API
BuddyPress 14.4.0 contains an insecure direct object reference vulnerability in the friends REST API that allows any authenticated attacker to enumerate another user's complete friend list. Attackers can query the friends endpoint with an arbitrary userid because the getitemspermissionscheck method only verifies that the requester is logged in and never checks ownership of the requested list, resulting in disclosure of users' private social connections.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Remove
Remove
BuddyPress 14.4.0from your environment.If BuddyPress (or its Friends component) is not required, uninstall or deactivate BuddyPress or disable the Friends component/module until an official fix is released to eliminate exposure from the vulnerable REST API.
- Compensating control
Block or restrict access to the BuddyPress friends REST API endpoints until a vendor patch is available. Implement a WAF rule, reverse-proxy rule, or firewall/ACL to prevent authenticated users from querying arbitrary friends endpoints (e.g., filter or deny requests that include friends endpoint paths or requests that specify arbitrary user_id values).
Event History
Frequently Asked Questions
What is the severity of CVE-2026-53675?
CVE-2026-53675 has a medium severity rating of 5.3.
How can I fix CVE-2026-53675?
To fix CVE-2026-53675, update BuddyPress to the latest version that addresses the friends REST API vulnerability.
What type of vulnerability is CVE-2026-53675?
CVE-2026-53675 is classified as an insecure direct object reference (IDOR) vulnerability.
Who is affected by CVE-2026-53675?
Any authenticated user of BuddyPress 14.4.0 can potentially exploit CVE-2026-53675 to access another user's friend list.
What can an attacker do with CVE-2026-53675?
An attacker can use CVE-2026-53675 to enumerate the complete friend list of any user by manipulating the user_id in the friends REST API.