Technical impact
The Restrictions for BuddyPress plugin for WordPress contains a missing capability check in the handle_optin_optout() function for all versions up to 1.5.2. This flaw falls under CWE‑862 (Broken Access Control) and allows anyone, even without authentication, to change a user's tracking opt‑in or opt‑out status. The impact is that an attacker can force tracking on or off, potentially violating user privacy and consent agreements.
Affected Systems
Affects the Restrictions for BuddyPress WordPress plugin developed by seventhqueen. The vulnerability exists in version 1.5.2 and earlier. Users running any of these versions are susceptible.
Risk and Exploitability
The CVSS score of 5.3 indicates a moderate severity. However, the EPSS score of less than 1% shows a very low probability of exploitation currently, and the vulnerability is not listed in the CISA KEV catalog, suggesting no known active attacks. Attackers would exploit the missing authorization by crafting an HTTP request to the handle_optin_optout() endpoint; no authentication is required, making the attack straightforward once the location is known. Given the low exploitation probability but still possible, administrators should assess whether tracking data is sensitive and prioritize patching accordingly.
