CVEvulnerability
CVE-2021-21389
8.8 HIGH
Official page ↗
- Status
- Modified
- Published
- 2021-03-26
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 3.1 ([email protected])
- 8.1 HIGH — CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
- CVSS 3.1 ([email protected])
- 8.8 HIGH — CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- CVSS 2.0 ([email protected])
- 9.0 HIGH — AV:N/AC:L/Au:S/C:C/I:C/A:C
- Weaknesses
- CWE-863
Description
BuddyPress is an open source WordPress plugin to build a community site. In releases of BuddyPress from 5.0.0 before 7.2.1 it's possible for a non-privileged, regular user to obtain administrator rights by exploiting an issue in the REST API members endpoint. The vulnerability has been fixed in BuddyPress 7.2.1. Existing installations of the plugin should be updated to this version to mitigate the issue.
Affected configurations
• buddypress buddypress (>= 5.0.0 < 7.2.1)
Related
Weakness · CWE (1)
- CWE-863 Incorrect Authorization weakness
References
- https://buddypress.org/2021/03/buddypress-7-2-1-security-release/ Release Notes, Vendor Advisory
- https://codex.buddypress.org/releases/version-7-2-1/ Release Notes, Vendor Advisory
- https://github.com/buddypress/BuddyPress/security/advisories/GHSA-m6j4-8r7p-wpp3 Third Party Advisory
- https://buddypress.org/2021/03/buddypress-7-2-1-security-release/ Release Notes, Vendor Advisory
- https://codex.buddypress.org/releases/version-7-2-1/ Release Notes, Vendor Advisory
- https://github.com/buddypress/BuddyPress/security/advisories/GHSA-m6j4-8r7p-wpp3 Third Party Advisory