CVE-2026-8155
Received Received - Intake

Unauthorized Access to Private Messages in BuddyPress

Publication date: 2026-07-31

Last updated on: 2026-07-31

Assigner: WPScan

Description
The BuddyPress WordPress plugin before 14.5.0 does not properly enforce authorization on its private messaging endpoints, allowing any authenticated user (Subscriber+) to read, modify, or delete other users' private messages.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-31
Last Modified
2026-07-31
Generated
2026-07-31
AI Q&A
2026-07-31
EPSS Evaluated
N/A
NVD
CVE-2026-8155
EUVD
EUVD-2026-51429

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
buddy_press buddy_press to 14.5.0 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

The BuddyPress WordPress plugin before version 14.5.0 has a vulnerability where private messaging endpoints do not enforce proper authorization checks. This allows any authenticated user with at least a Subscriber role to read, modify, or delete private messages of other users.

Detection Guidance

I don't know

Check BuddyPress version with WordPress plugin list command. Inspect private message endpoints for unauthorized access patterns.

Impact Analysis

This vulnerability could lead to unauthorized access to private conversations, data leaks, or manipulation of messages. Users' sensitive information shared via private messages may be exposed, and message integrity could be compromised.

Compliance Impact

This vulnerability may violate data protection regulations like GDPR and HIPAA by exposing private user data without authorization. Organizations using the vulnerable plugin could face compliance violations, legal penalties, and reputational damage.

Mitigation Strategies

Update BuddyPress to version 14.5.0 or later immediately. Review user permissions to ensure only necessary roles can access private messaging. Monitor for unauthorized message access or modifications.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-8155. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart