BuddyPress 14.4.0 includes an IDOR flaw in its friends REST API that allows any authenticated user to retrieve another user's friend list. Because the API endpoint only checks that the requester is logged in and does not verify ownership of the requested list, an attacker can discover a target user's private social connections, violating confidentiality. The vulnerability does not affect integrity or availability. The weakness is classified as CWE‑639.

The affected product is the BuddyPress WordPress plugin, version 14.4.0. No other versions are listed as impacted; the issue is specific to this release of the plugin for the WordPress platform.

With a CVSS score of 5.3, the risk is moderate, and the EPSS score is not available. The vulnerability is not listed in CISA KEV, indicating no confirmed network exploitation. The attack requires an authenticated session, but any logged‑in user can supply an arbitrary user_id to the friends endpoint, making the exploit trivial for authenticated attackers without additional privileges.