CVE-2026-53675: BuddyPress Information Disclosure Flaw

CVE-2026-53675 Overview

CVE-2026-53675 is an insecure direct object reference (IDOR) vulnerability in BuddyPress 14.4.0, a social networking plugin for WordPress. The flaw resides in the friends REST API endpoint, which fails to validate ownership of the requested resource. Any authenticated user can query the endpoint with an arbitrary user_id parameter and retrieve another user's complete friend list. The get_items_permissions_check method only confirms the requester is logged in, never verifying they own or have permission to view the targeted list. This results in unauthorized disclosure of users' private social connections across the affected installation.

Critical Impact
Any authenticated low-privilege user can enumerate the complete friend lists of all other BuddyPress users via the REST API, exposing private social graph data.

Affected Products

BuddyPress 14.4.0
WordPress installations running the BuddyPress plugin at the affected version
Sites exposing the BuddyPress friends REST API endpoint

Discovery Timeline

2026-06-10 - CVE-2026-53675 published to NVD
2026-06-10 - Last updated in NVD database

Technical Details for CVE-2026-53675

Vulnerability Analysis

The vulnerability is classified as an Insecure Direct Object Reference [CWE-639]. BuddyPress exposes a friends REST API endpoint that accepts a user_id query parameter identifying whose friend list to return. The endpoint's permission callback, get_items_permissions_check, performs only an authentication check. It does not compare the authenticated user's ID to the requested user_id, nor does it confirm the caller has a relationship or administrative right to view the target's friend list.

Because REST permission callbacks are the primary authorization boundary in WordPress, the missing ownership check allows any logged-in account, including subscriber-level users, to enumerate the social connections of arbitrary user IDs. The disclosed data is limited to friend relationships, so the impact is bounded to confidentiality of private social graph metadata.

Root Cause

The root cause is a missing authorization check in the friends collection endpoint. The permission callback validates is_user_logged_in() semantics but omits a comparison between the current user and the requested resource owner. Object access decisions rely on a client-supplied identifier without a corresponding server-side ownership or visibility policy.

Attack Vector

Exploitation requires only a valid authenticated session on the target WordPress site. An attacker registers or compromises any user account, then issues authenticated GET requests to the BuddyPress friends REST endpoint, iterating the user_id parameter to enumerate friend lists for arbitrary users. No user interaction, elevated privileges, or special configuration is required beyond standard BuddyPress deployment. See the VulnCheck Advisory - BuddyPress IDOR for endpoint-level technical details.

No verified public exploit code is available; the vulnerability is described in prose only.

Detection Methods for CVE-2026-53675

Indicators of Compromise

Repeated authenticated requests to BuddyPress friends REST endpoints with sequentially varying user_id parameters from a single account or IP.
Web server access logs showing a single low-privilege user enumerating REST paths under /wp-json/buddypress/v1/friends against many distinct user IDs.
Anomalous volume of REST API calls from accounts that historically had minimal interaction with friend-related features.

Detection Strategies

Parse WordPress and web server logs for high-cardinality user_id values queried by the same authenticated session within short time windows.
Alert on REST API requests to BuddyPress friend endpoints where the authenticated user differs from the requested user_id and the requester is not an administrator.
Correlate newly registered accounts with rapid follow-on enumeration of BuddyPress REST endpoints.

Monitoring Recommendations

Enable verbose REST API request logging for the BuddyPress plugin and forward logs to a centralized analytics platform.
Establish a baseline for normal friends endpoint traffic and trigger alerts on deviations in volume or user-ID diversity.
Review user registration patterns on public BuddyPress sites for accounts created solely to exercise the REST API.

How to Mitigate CVE-2026-53675

Immediate Actions Required

Upgrade BuddyPress to a version that includes the fix for CVE-2026-53675 once released by the maintainers, tracked on the BuddyPress Plugin Page.
Restrict new user registration on affected sites until the plugin is patched to reduce the population of accounts able to exploit the issue.
Audit existing accounts for suspicious enumeration activity against the friends REST endpoint.

Patch Information

Review the VulnCheck Advisory - BuddyPress IDOR and the BuddyPress Official Site for patch availability and updated release notes. Apply the fixed plugin version through the standard WordPress plugin update mechanism once published.

Workarounds

Disable the BuddyPress friends component from the BuddyPress Components settings if friend functionality is not required.
Use a WordPress security or WAF plugin to block REST requests to /wp-json/buddypress/v1/friends where the requested user_id does not match the authenticated user.
Restrict access to the BuddyPress REST namespace at the web server or reverse proxy layer for unauthenticated and low-trust networks.

bash

# Example: block mismatched user_id queries to the friends endpoint at the web server
# (illustrative nginx rule - validate before deploying in production)
location ~ ^/wp-json/buddypress/v1/friends {
    if ($arg_user_id != "") {
        # forward to WordPress, which after patching enforces ownership checks
        proxy_pass http://wordpress_upstream;
    }
}