Description

The BuddyPress plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 14.3.3 via the bp_notifications_action_bulk_manage due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with Subscriber-level access and above, to delete/mark as read/mark as unread notifications of other users.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "4.3",
  "pubDate": "2026-09-11T12:16:50.957Z",
  "pubdate": "2026-09-11T12:16:50.957Z",
  "executiveSummary": "The BuddyPress plugin for WordPress is susceptible to an Insecure Direct Object Reference (IDOR) vulnerability identified in versions up to and including 14.3.3. This security flaw exists within the 'bp_notifications_action_bulk_manage' function, which fails to adequately validate the ownership of notification identifiers processed during bulk operations.\nThe vulnerability allows authenticated users with at least Subscriber-level privileges to perform unauthorized administrative actions on notifications belonging to other system users. By manipulating the user-controlled input keys associated with notification objects, an attacker can programmatically trigger 'delete', 'mark as read', or 'mark as unread' status changes on arbitrary notification records.\nThe impact includes unauthorized modification of user data and potential disruption of critical communication flows within the WordPress environment. This vulnerability highlights a failure in server-side authorization logic, where the application assumes that the presence of an authenticated session is sufficient for processing bulk requests, neglecting the necessity for per-object access control checks. Exploitation is feasible via direct requests to the affected endpoint, requiring no advanced privileges beyond standard authenticated user access. Given the widespread use of BuddyPress in community-driven WordPress sites, the risk implications are significant, potentially leading to unauthorized data manipulation or administrative interference with user notifications.",
  "technicalDetails": "The root cause of this vulnerability lies in the implementation of the 'bp_notifications_action_bulk_manage' function within BuddyPress. The function processes bulk management requests for user notifications but fails to implement a robust access control layer to verify if the requesting user has the authority to act upon the specified notification IDs provided in the request payload.\nSpecifically, the component accepts user-supplied identifiers intended to represent specific notification objects. Because the application logic does not cross-reference these identifiers with the session-derived user ID (User ID of the current authenticated user), the backend processes the request blindly against the database. This allows an attacker to supply notification IDs that do not belong to their own account, causing the underlying database queries to execute operations on cross-user records.\nThe attack flow follows a predictable pattern: 1) An authenticated attacker identifies valid notification IDs, possibly through legitimate interaction or enumeration. 2) The attacker constructs a POST request targeting the 'bp_notifications_action_bulk_manage' endpoint. 3) The request includes a manipulated payload where the 'id' parameter corresponds to notifications belonging to a victim user. 4) The server processes the bulk action without performing a ownership check, effectively allowing the attacker to execute status changes (e.g., 'delete', 'is_new') on records belonging to any other user in the database.\nThis vulnerability is classified as an IDOR because the system trust model relies on the attacker providing a valid ID rather than the system validating that the object belongs to the requester. The lack of authorization checks at the service layer ensures that the database operations are performed with the context of the global user session, rather than scoped to the specific user's notification set. Post-exploitation impact includes the ability for an attacker to systematically clear notification queues for administrators or other users, effectively causing a denial of information service or potentially masking malicious activity by marking sensitive notifications as read.\nAffected versions include all BuddyPress versions up to and including 14.3.3. The vulnerability is accessible over the network via standard HTTP requests and requires authentication, though the privilege requirement is limited to the lowest 'Subscriber' level, maximizing the threat landscape for any public-facing BuddyPress installation."
}