Description
WordPress Plugin BuddyPress is prone to multiple security bypass vulnerabilities. Exploiting these issues may allow attackers to perform otherwise restricted actions and subsequently create groups on behalf of another members, to favorite any private/hidden activities, or more. WordPress Plugin BuddyPress version 7.2.1 is vulnerable; prior versions may also be affected.
Remediation
Update to plugin version 7.3.0 or latest
References
Related Vulnerabilities
WordPress Plugin WP Subscribe Cross-Site Scripting (1.0.2)
WordPress Plugin Easy Accept Payments for PayPal Cross-Site Scripting (4.9.9)
WordPress Plugin Print Invoice & Delivery Notes for WooCommerce Cross-Site Request Forgery (4.7.2)
WordPress 5.0 Multiple Vulnerabilities (5.0)
WordPress Plugin Facebook Like Box Unspecified Vulnerability (1.0.17)