CVE-2024-12145 Overview
CVE-2024-12145 is an Insecure Direct Object Reference (IDOR) vulnerability in the BuddyPress plugin for WordPress. The flaw affects all versions up to and including 14.3.3. The issue resides in the bp_notifications_action_bulk_manage function, which fails to validate a user-controlled key before acting on notification records. Authenticated users with Subscriber-level access or higher can manipulate notifications belonging to other users. Attackers can delete, mark as read, or mark as unread notifications owned by any account. The weakness is tracked as Missing Authorization [CWE-862].
Critical Impact
Any authenticated Subscriber can tamper with other users' notification records, breaking notification integrity and enabling denial of important alerts.
Affected Products
- BuddyPress plugin for WordPress, all versions up to and including 14.3.3
- WordPress sites running BuddyPress with open user registration exposing Subscriber-level accounts
- Multisite WordPress installations where BuddyPress is network-activated on vulnerable versions
Discovery Timeline
- 2026-09-11 - CVE-2024-12145 published to the National Vulnerability Database
- 2026-09-11 - Last updated in NVD database
Technical Details for CVE-2024-12145
Vulnerability Analysis
The vulnerability stems from missing authorization checks in BuddyPress's bulk notification management workflow. The bp_notifications_action_bulk_manage handler processes a list of notification identifiers submitted by the requesting user. The handler acts on those identifiers without confirming that they belong to the authenticated caller. This design choice lets an attacker enumerate or guess notification IDs and issue bulk actions against them. The request only requires authentication at the Subscriber level, which is the lowest privileged role on typical BuddyPress-enabled sites. Successful abuse does not disclose notification content, but it does allow silent deletion or state manipulation of other users' notifications. The integrity of the notification subsystem is therefore compromised across the entire site.
Root Cause
The root cause is a missing ownership check on the notification identifiers passed to bp_notifications_action_bulk_manage. BuddyPress trusts the client-supplied key without verifying that the current user owns each targeted record. This is a classic IDOR pattern classified under CWE-862 Missing Authorization.
Attack Vector
The attack is remote and requires an authenticated session with Subscriber privileges or higher. The attacker submits a crafted bulk-manage request containing notification IDs owned by other users. The server processes the requested action, such as delete, read, or unread, against those IDs. No user interaction from the victim is required. See the Wordfence Vulnerability Report and the fix in the WordPress Plugin Changeset for implementation-level details.
Detection Methods for CVE-2024-12145
Indicators of Compromise
- Unexpected deletion of notifications reported by end users on BuddyPress-enabled sites.
- Bulk POST requests to BuddyPress notification endpoints containing arrays of notification IDs from Subscriber-level accounts.
- Access log entries showing repeated notification bulk-manage actions from a single low-privilege account within a short time window.
Detection Strategies
- Review web server logs for POST requests to BuddyPress notification management endpoints that include the bulk_manage action parameter.
- Correlate the authenticated user ID in the session with the notification IDs targeted in bulk requests to identify cross-user access.
- Audit WordPress database changes on the wp_bp_notifications table for deletions or state changes originating from unexpected accounts.
Monitoring Recommendations
- Enable WordPress audit logging on BuddyPress notification actions and forward events to a central log repository.
- Alert on anomalous bulk actions from newly registered or Subscriber-level accounts against notification objects.
- Track sudden drops in notification counts per user as a behavioral signal of tampering.
How to Mitigate CVE-2024-12145
Immediate Actions Required
- Upgrade the BuddyPress plugin to the version that includes the fix from changeset 3259392, which is a release after 14.3.3.
- Inventory all WordPress sites and identify BuddyPress installations at or below version 14.3.3.
- Temporarily restrict new user registrations on affected sites until the patch is deployed.
Patch Information
The BuddyPress maintainers addressed the missing authorization check in the notification bulk-manage handler. The fix is committed in WordPress Plugin Changeset 3259392. Site operators should update BuddyPress to the first stable release that includes this changeset. Additional context is available in the Wordfence Vulnerability Report.
Workarounds
- Disable the BuddyPress notifications component from the BuddyPress settings screen if upgrading is not immediately possible.
- Restrict access to BuddyPress endpoints through a web application firewall rule that blocks bulk-manage requests from Subscriber accounts.
- Enforce stronger role assignment so that anonymous registration does not automatically grant access to BuddyPress community features.
# Configuration example: update BuddyPress via WP-CLI
wp plugin update buddypress
wp plugin get buddypress --field=version
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
