This vulnerability exists in the BuddyBoss Platform Pro plugin for WordPress up to and including version 2.7.01. An unauthenticated attacker can take advantage of insufficient verification of the user supplied during the Apple OAuth authentication flow. By providing a valid email address belonging to an existing user, the plugin incorrectly trusts the request and logs the attacker in as that user. The compromised account gains the full permissions of the impersonated account, potentially allowing complete control over the site.

BuddyBoss Platform Pro, a plugin for WordPress, is affected. All installations using version 2.7.01 or earlier are vulnerable. Versions released after 2.7.01 are not impacted.

The CVSS score of 9.8 highlights critical severity, and an EPSS score of 1% indicates that, while exploitation is likely not widespread yet, the vulnerability is still a high‑risk target for motivated attackers. This issue is not listed in the CISA KEV catalog, but the authentication bypass allows remote attackers to achieve full site compromise. The likely attack vector involves an attacker triggering the Apple OAuth authentication process with a crafted request that includes the target user’s email address.