BuddyPress 14.4.0 contains an insecure direct object reference vulnerability in its messages REST API. The flaw allows an authenticated attacker to supply an arbitrary user_id parameter, causing the get_item_permissions_check method to validate the supplied ID instead of the logged‑in user. Because the same check is reused by update and delete handlers, the attacker can read, reply to, or delete any private message thread belonging to another user.

The vulnerability affects the BuddyPress plugin, version 14.4.0, installed in WordPress sites. Any site running this exact plugin version is susceptible; later versions are not affected.

With a CVSS score of 8.6, the issue carries high severity. Exploitation requires that the attacker be logged into a WordPress account with read or higher privileges; the attack vector is through the REST API where an attacker can send a user_id parameter to target another user. The EPSS score is not available, and the flaw is not listed in CISA KEV, indicating no widely known exploitation at this time. Nevertheless, the ability to access private messages poses significant confidentiality risk.