CVE-2024-12145

4.3 Moyenne

Publiée le 11/09/2026 à 14:16 · Modifiée le 11/09/2026 à 23:17 · Analyse NVD reportée · Source : security@wordfence.com

Description

The BuddyPress plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 14.3.3 via the bp_notifications_action_bulk_manage due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with Subscriber-level access and above, to delete/mark as read/mark as unread notifications of other users.

Traduire en français

Produits concernés

BuddyPress

Scores CVSS

Version	Score	Source	Vecteur
3.1	4.3 Moyenne	security@wordfence.com	`CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N`

Faiblesses (CWE)

CWE-862

Références

https://plugins.trac.wordpress.org/changeset/3259392/
https://www.wordfence.com/threat-intel/vulnerabilities/id/8c2965c0-a07f-46a2-b06c-fa2e739aea94?source=cve

Ailleurs

NVD
CVE.org
CIRCL Vulnerability-Lookup
CERT-FR
GitHub Advisories