CVE-2026-8155— BuddyPress < 14.5.0 - Subscriber+ Private Messages Disclosure via IDOR
Possible ATT&CK Techniques 1AI
T1530 · Data from Cloud StorageAffected Version Matrix 1
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| Unknown | BuddyPress | < 14.5.0 | affected |
Get alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2026-8155
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
BuddyPress < 14.5.0 - Subscriber+ Private Messages Disclosure via IDOR
Source: CVE Program / CVE List V5
Vulnerability Description
The BuddyPress WordPress plugin before 14.5.0 does not properly enforce authorization on its private messaging endpoints, allowing any authenticated user (Subscriber+) to read, modify, or delete other users' private messages.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Unknown | BuddyPress | 0 ~ 14.5.0 | - |
II. Public POCs for CVE-2026-8155
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCPremium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-8155
请登录查看更多情报信息。
Vendor Advisories for CVE-2026-8155 (1)
- 🔗 BuddyPress < 14.5.0 – Subscriber+ Private Messages Disclosure via IDOR | CVE 2026-8155 | Plugin Vulnerabilities Read full article exploitvdb-entrytechnical-description
Same Patch Batch · Unknown · 2026-07-31 · 34 CVEs total
| CVE-2026-12721 | Kirki < 6.0.13 - Unauthenticated SQL Injection | |
| CVE-2026-14931 | JS Help Desk < 3.1.4 - Contributor+ User Email Disclosure | |
| CVE-2026-14930 | JS Help Desk < 3.1.4 - Unauthenticated Arbitrary Ticket File Attachment Upload | |
| CVE-2026-15381 | WP Go Maps < 10.1.04 - Unauthenticated SQL Injection via Markers REST filter | |
| CVE-2026-15209 | JS Help Desk – AI-Powered Support & Ticketing System < 3.1.5 - Subscriber+ Cross-User Supp | |
| CVE-2026-15258 | Product Feed Manager for WooCommerce < 7.6.1 - Contributor+ SQL Injection via Feed Filter | |
| CVE-2026-12251 | Ultimate Member < 2.12.1 - Unauthenticated Privilege Escalation via Role Selection Field | |
| CVE-2026-12376 | Academy LMS <= 3.8.2 - Subscriber+ Sensitive Information Disclosure via quiz_attempts REST | |
| CVE-2026-12720 | Kirki < 6.0.13 - Unauthenticated PHP Object Injection | |
| CVE-2026-14929 | JS Help Desk < 3.1.4 - Subscriber+ Ticket Reply Modification via IDOR | |
| CVE-2026-13393 | ElementsKit Lite < 3.10.01 - Subsite Administrator+ Stored XSS via Megamenu Menu-Item Sett | |
| CVE-2026-13392 | ElementsKit Lite < 3.10.01 - Subsite Administrator+ PHP Code Injection via Custom Widget B | |
| CVE-2026-14862 | Support Genix Lite < 1.4.48 - Unauthenticated Ticket Attachment Download via Missing Autho | |
| CVE-2026-14919 | ShopMonitor.io < 1.2.0 - Unauthenticated Administrator Account Takeover via Password-Reset | |
| CVE-2026-12697 | wpForo Forum < 3.1.2 - Subscriber+ Cross-User AI Chat Message Deletion via IDOR | |
| CVE-2026-12695 | miniOrange 2FA < 6.2.6 - 2FA Bypass via Attacker-Controlled ga_secret | |
| CVE-2026-13609 | Frontend Admin by DynamiApps < 3.29.9 - Unauthenticated Stored Cross-Site Scripting via Fo | |
| CVE-2026-14333 | Demi - One Click Demo Import, Backup & Site Migration < 0.0.7 - Unauthenticated Sensitive | |
| CVE-2026-15048 | GeekyBot < 1.2.8 - Unauthenticated Sensitive Information Exposure via Chat History | |
| CVE-2026-14927 | FluentCart < 1.5.3 - Unauthenticated Order PII Disclosure via Print Routes |
Showing top 20 of 34 CVEs. View all on vendor page → →
IV. Related Vulnerabilities
Same product: BuddyPress
- CVE-2026-1360
BuddyPress <= 14.5.0 - Authenticated (Subscriber+) PHP Objec - CVE-2026-53675
BuddyPress 14.4.0 Friends List IDOR via REST API - CVE-2026-53673
BuddyPress 14.4.0 Private Message IDOR via REST API user_id - CVE-2026-53674
BuddyPress 14.4.0 REGEXP Injection via @Mention Username Res - CVE-2020-37233
WordPress Plugin Buddypress 6.2.0 Persistent Cross-Site Scri
Same vendor: Unknown
- CVE-2026-15236
Gallery for Google Photos < 1.2.1 - Unauthenticated Google O - CVE-2026-13389
WebToffee Cookie Consent < 3.5.3 - Consent Log Disclosure/De - CVE-2026-16064
Event Booking Manager for WooCommerce < 5.3.7 - Contributor+ - CVE-2026-16062
Event Booking Manager for WooCommerce < 5.3.7 - Contributor+ - CVE-2026-16063
Event Booking Manager for WooCommerce < 5.3.7 - Author+ Stor
V. Comments for CVE-2026-8155
No comments yet