CVE-2026-8155: Unknown Buddypress

Medium severity, CVSS 5.4. EPSS: 0.2% chance of exploitation in the next 30 days.

The BuddyPress WordPress plugin before 14.5.0 does not properly enforce authorization on its private messaging endpoints, allowing any authenticated user (Subscriber+) to read, modify, or delete other users' private messages.

Affected products

• Unknown Buddypress: before 14.5.0 (fixed in 14.5.0)

Published 2026-07-31. Last modified 2026-08-26.