The BuddyTask plugin for WordPress suffers from a missing capability check on multiple AJAX endpoints in all released versions through 1.3.0, a flaw identified as CWE‑862 (Missing Authorization). The flaw allows an authenticated user who holds a Subscriber role or higher to bypass access controls and perform actions against any task board tied to a BuddyPress group, regardless of group visibility. As a result, an attacker can view, create, modify, or delete task boards for any group, including private or hidden groups to which they do not belong.

This issue affects installations of the BuddyTask plugin for WordPress up to and including version 1.3.0. There are no distinct vendor or product versions beyond the provided range; any instance of BuddyTask at or below this version is susceptible.

The vulnerability has a CVSS score of 5.4, indicating a moderate impact. The EPSS score is less than 1 %, suggesting a low probability of exploitation at this time, and the flaw is not listed in the CISA KEV catalog. However, an attacker only needs to be authenticated with a Subscriber account or higher, which is a very common role on WordPress sites, so the attack vector is likely local to the site’s authentication system. Once authenticated, exploitation allows the attacker to compromise the integrity and confidentiality of task board data across all groups, potentially exposing sensitive group discussions and project tasks.