Vulnerability Monitor

The vendors, products, and vulnerabilities you care about

CVE-2021-21389

BuddyPress is an open source WordPress plugin to build a community site. In releases of BuddyPress from 5.0.0 before 7.2.1 it's possible for a non-privileged, regular user to obtain administrator rights by exploiting an issue in the REST API members endpoint. The vulnerability has been fixed in BuddyPress 7.2.1. Existing installations of the plugin should be updated to this version to mitigate the issue.

Published

2021-03-26T21:15:13.520

Last Modified

2024-11-21T05:48:15.500

Status

Modified

Source

[email protected]

Severity

CVSSv3.1: 8.1 (HIGH)

CVSSv2 Vector

AV:N/AC:L/Au:S/C:C/I:C/A:C

Access Vector: NETWORK
Access Complexity: LOW
Authentication: SINGLE
Confidentiality Impact: COMPLETE
Integrity Impact: COMPLETE
Availability Impact: COMPLETE

Exploitability Score

8.0

Impact Score

10.0

Weaknesses

Type: Primary
CWE-863

Affected Vendors & Products

Type	Vendor	Product	Version/Range	Vulnerable?
Application	buddypress	buddypress	< 7.2.1	Yes

References

https://buddypress.org/2021/03/buddypress-7-2-1-security-release/ Release Notes, Vendor Advisory ([email protected])
https://codex.buddypress.org/releases/version-7-2-1/ Release Notes, Vendor Advisory ([email protected])
https://github.com/buddypress/BuddyPress/security/advisories/GHSA-m6j4-8r7p-wpp3 Third Party Advisory ([email protected])
https://buddypress.org/2021/03/buddypress-7-2-1-security-release/ Release Notes, Vendor Advisory (af854a3a-2127-422b-91ae-364da2661108)
https://codex.buddypress.org/releases/version-7-2-1/ Release Notes, Vendor Advisory (af854a3a-2127-422b-91ae-364da2661108)
https://github.com/buddypress/BuddyPress/security/advisories/GHSA-m6j4-8r7p-wpp3 Third Party Advisory (af854a3a-2127-422b-91ae-364da2661108)