The BuddyPress WordPress plugin version 14.5.0 and earlier lack proper authorization checks on private messaging endpoints. Any user with an authenticated account, including Subscribers, can request the contents of another user’s private messages, modify them, or delete them. This flaw enables an attacker to compromise the confidentiality of private communications, tamper with message integrity, and potentially disrupt messaging functionality for other users.

WordPress sites that use the BuddyPress plugin in versions prior to 14.5.0 are impacted. The vulnerability resides in the plugin’s messaging API that is presented to any logged‑in user.

Because the attack requires only a valid user account, common users or compromised accounts can exploit the flaw. The CVSS score of 5.4 indicates a medium severity, and the EPSS score is less than 1 %, meaning a low but non‑zero exploitation probability. The vulnerability is not listed in the CISA KEV catalog. However, the lack of authorization checks means that once an account is authenticated, the attacker can freely access other users’ messages. No additional privileges are needed, so the practical exploitability is high for any site that allows normal user logins and uses private messaging.