A cross‑site request forgery flaw exists in the Buddypress Humanity WordPress plugin by Adam Nowak. The vulnerability allows an attacker to craft a request that is processed by the site on behalf of an authenticated user. Based on the description, the flaw could enable the attacker to perform privileged actions that the user has rights to, such as creating, modifying, or deleting content or users.

The Buddypress Humanity WordPress plugin, versions 1.0 through 1.2, is impacted. Any WordPress site that hosts a copy of these versions of the plugin is vulnerable despite other security measures.

The CVSS score of 9.8 signals a critical severity. The EPSS score of less than 1 % indicates that, at the time of assessment, exploitation probability is low, and the vulnerability is not listed in CISA’s KEV catalog. The likely attack vector involves an authenticated user being tricked into visiting a crafted URL that submits a forged request; because the plugin lacks adequate CSRF protection, the request is accepted and executed, potentially leading to privilege escalation.