CVE-2024-12145

Executive Summary

CVE-2024-12145 is an Insecure Direct Object Reference (IDOR) vulnerability in the BuddyPress plugin for WordPress affecting all versions up to and including 14.3.3. The flaw resides in the bp_notifications_action_bulk_manage functionality, where missing validation on a user-controlled key allows authenticated attackers with Subscriber-level access or above to delete, mark as read, or mark as unread notifications belonging to other users. While the CVSS score is moderate (4.3), the low privilege requirement and network accessibility make this a viable component of broader WordPress-targeted attack chains.

Technical Analysis

The vulnerability is classified as CWE-862 (Missing Authorization) and manifests as an Insecure Direct Object Reference within the BuddyPress notification management subsystem. BuddyPress is a widely deployed WordPress plugin that adds social networking capabilities—profiles, activity streams, groups, and private messaging—to WordPress sites. Its notification system tracks user-specific events (mentions, friend requests, group invitations, message alerts) and exposes bulk management actions to logged-in users.

The vulnerable function, bp_notifications_action_bulk_manage, is invoked when an authenticated user performs bulk operations on their notification inbox. The core defect is that the function accepts a user-controlled key (typically an object identifier such as a notification ID or an array of notification IDs) and acts upon it without verifying that the referenced notification objects actually belong to the requesting user. In a correctly implemented authorization model, the server should verify ownership of each notification ID against the authenticated session's user ID before executing the delete/read/unread operation. Here, that ownership check is absent or insufficient, producing a classic IDOR.

The attack surface is the WordPress AJAX or admin-post endpoint that dispatches notification bulk actions. Because BuddyPress registers this handler for authenticated users at the Subscriber role and above, any user who can register or who holds a low-privilege account on the target site can invoke the vulnerable action. The required precondition is only an authenticated session and knowledge (or enumeration) of notification IDs belonging to other users.

From an integrity standpoint, the impact is bounded: the attacker can alter the read/unread state of another user's notifications or delete them outright. There is no disclosure of notification content (C:N in the CVSS vector) and no availability impact to core services (A:N). However, notification deletion can be used to suppress security-relevant alerts—for example, password reset notices, security plugin warnings, or membership approval notifications delivered through BuddyPress—creating follow-on risk for account takeover and social engineering.

Note: The NVD description provides the function name and vulnerability class but does not disclose the exact request parameter name, HTTP verb, or endpoint path. No public proof-of-concept, Nuclei template, or exploit code is available as of this report. The technical mechanism is therefore described at the vulnerability-class level consistent with the CWE-862/IDOR classification.

Exploitation Scenarios

Because no public PoC exists, the following attack chain is inferred strictly from the vulnerability class (authenticated IDOR with missing authorization) and the data provided in the NVD description. No specific endpoint paths, parameter names, or payload syntax are asserted beyond those explicitly named.

1. Reconnaissance / target identification. The attacker identifies WordPress sites running BuddyPress by fingerprinting wp-content/plugins/buddypress/ assets, BuddyPress-specific markup, or WordPress REST/AJAX behaviors. Registration is often open on community sites, so obtaining a Subscriber-level account is trivial—either via self-registration or a compromised low-privilege credential.

2. Triggering the flaw class. With an authenticated Subscriber session established, the attacker interacts with the BuddyPress notification bulk-management functionality (bp_notifications_action_bulk_manage). The classic IDOR trigger is to supply an object identifier that references notifications belonging to another user rather than the attacker. The missing authorization check means the server processes the request without confirming ownership.

3. Execution method (class-level). The attacker submits a bulk-manage action carrying one or more notification identifiers. Because identifiers in such systems are frequently sequential or otherwise predictable integers, an attacker can iterate/guess plausible IDs to target other users' notifications. The three abusable operations named in the advisory—delete, mark as read, and mark as unread—each represent a distinct state-change request against those foreign objects. No specific parameter name is disclosed in the source data, so the exact request syntax cannot be stated here.

4. Post-exploitation impact. The attacker alters the state of other users' notification inboxes: deleting notifications, or flipping read/unread status. This yields limited but meaningful integrity impact—suppressing notifications (including potentially security-relevant ones), creating confusion, or degrading the reliability of the platform's notification channel. Combined with other flaws, notification suppression can aid follow-on social engineering or account takeover attempts by hiding alerts from victims.

Impact Assessment

The CVSS v3.1 base score is 4.3 (Medium), vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N. Decomposition:

• Attack Vector: Network (N) — exploit is reachable remotely over HTTP/HTTPS; no local access required.
• Attack Complexity: Low (L) — no special conditions or race windows; the bug is exploitable with standard requests.
• Privileges Required: Low (L) — a Subscriber-level authenticated account suffices, which is a low barrier on sites permitting registration.
• User Interaction: None (N) — no victim action needed; the attacker acts directly against the server.
• Scope: Unchanged (U) — impact remains within the vulnerable component's security authority.
• Confidentiality: None (N) — notification content is not disclosed.
• Integrity: Low (L) — attackers can modify/delete states of others' notifications (limited, non-critical data).
• Availability: None (N) — no denial of service to core functions.

Blast radius. Any WordPress installation running BuddyPress ≤ 14.3.3 with authenticated users at Subscriber level or higher is exposed. Community, membership, and social platforms are prime targets because they commonly allow public registration. Business impact is primarily integrity and trust-related: suppression of user notifications can undermine engagement workflows, mask security alerts, and, in aggregate, enable more damaging follow-on attacks. The absence of confidentiality and availability impact keeps the score moderate, but the low privilege bar and remote reachability mean real-world exposure is broad across the WordPress ecosystem. No known exploitation in the wild or CISA KEV listing is associated with this CVE.

Detection Guidance

Sigma Rule

title: BuddyPress Notification Bulk-Manage IDOR Attempt (CVE-2024-12145)
id: 7c3a9f2e-1b4d-4f8a-9e21-buddypress12145
status: experimental
description: Detects requests invoking BuddyPress bp_notifications_action_bulk_manage that may indicate IDOR-based manipulation of other users' notifications.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2024-12145
author: valtersit.com
date: 2025/01/01
logsource:
  category: webserver
  product: apache
detection:
  selection_endpoint:
    cs-uri-query|contains:
      - 'bp_notifications_action_bulk_manage'
      - 'bp-notifications'
  selection_action:
    cs-uri-query|contains:
      - 'bulk_manage'
      - 'notification_id'
  condition: selection_endpoint or selection_action
fields:
  - c-ip
  - cs-uri-query
  - cs-username
falsepositives:
  - Legitimate logged-in users managing their own notifications
level: medium

YARA Rule

rule CVE_2024_12145_BuddyPress_IDOR
{
    meta:
        description = "Detects references to the vulnerable BuddyPress bulk notification handler associated with CVE-2024-12145"
        author = "valtersit.com"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2024-12145"
        date = "2025-01-01"
        severity = "medium"

    strings:
        $fn   = "bp_notifications_action_bulk_manage" ascii wide
        $plug = "buddypress" ascii wide nocase
        $act1 = "mark_as_read" ascii wide
        $act2 = "mark_as_unread" ascii wide

    condition:
        $fn and (any of ($act1, $act2)) and $plug
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2024-12145 BuddyPress Notification Bulk-Manage IDOR Attempt"; flow:established,to_server; http.method; content:"POST"; http.uri; content:"bp_notifications_action_bulk_manage"; nocase; http.uri; content:"bulk_manage"; nocase; classtype:attempted-user; reference:cve,2024-12145; sid:202412145; rev:1;)

Elastic Detection

sequence by source.ip with maxspan=5m
  [ network where http.request.method == "POST" and
      http.request.uri : "*bp_notifications_action_bulk_manage*" and
      http.request.uri : "*bulk_manage*" ]

Splunk SPL Query

index=web sourcetype=access_combined OR sourcetype=apache:access
| search uri="*bp_notifications_action_bulk_manage*" OR uri="*bulk_manage*"
| stats count values(uri) as uris by clientip, useragent
| where count > 5
| sort - count

Wazuh OSSEC Rule

<group name="web,buddypress,cve-2024-12145,">
  <rule id="100145" level="8">
    <decoded_as>web-accesslog</decoded_as>
    <url>bp_notifications_action_bulk_manage</url>
    <description>CVE-2024-12145: Possible BuddyPress notification bulk-manage IDOR attempt</description>
    <mitre>
      <id>T1190</id>
    </mitre>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence is 2/4 (CLAIMED) — a single source (NVD) indicates a patch exists, but no specific fixed version, vendor advisory, or independent confirmation has been provided. Treat the following as best-effort guidance pending verification.

1. Immediate mitigations.

   • Restrict user registration or require administrative approval so unauthenticated parties cannot self-provision Subscriber accounts, raising the exploitation barrier.
   • If a WAF is available, create rules to block or rate-limit requests invoking the bp_notifications_action_bulk_manage bulk action from accounts exhibiting enumeration behavior (rapid sequential notification-ID activity).
   • Audit BuddyPress notification activity for unauthorized state changes and monitor for bulk deletion patterns.

2. Patch / upgrade steps.

   • Check the official BuddyPress release channel and the WordPress plugin repository for a version newer than 14.3.3 containing the authorization fix.
   • Because the patch is only CLAIMED, verify the release notes explicitly reference the notification authorization fix before relying on it; if no patched version is confirmed, treat the plugin as unpatched and apply compensating controls.
   • Stage the update on a test instance before production rollout and validate notification workflows afterward.

3. Long-term hardening.

   • Enforce server-side ownership checks on every object reference: validate that the authenticated user owns each notification ID before any state change (a capability/ownership check, not just authentication).
   • Adopt the principle of least privilege for Subscriber accounts and disable public registration where not required.
   • Monitor dependency advisories for BuddyPress and WordPress plugins generally; integrate plugin vulnerability data into your SBOM/vulnerability management pipeline.

References

• NVD — CVE-2024-12145: https://nvd.nist.gov/vuln/detail/CVE-2024-12145
• MITRE CWE-862 (Missing Authorization): https://cwe.mitre.org/data/definitions/862.html
• OWASP — Insecure Direct Object Reference (IDOR): https://owasp.org/www-project-top-ten/
• WordPress Plugin Directory — BuddyPress: https://wordpress.org/plugins/buddypress/
• FIRST EPSS: Not yet scored for this CVE (no value available at time of writing)

No threat actor campaigns or exploit-in-the-wild activity have been identified for CVE-2024-12145. No public PoC, Nuclei template, or exploit code is known; the exploitation chain above is inferred from the vulnerability class and the details in the NVD description.