CVE-2021-21389highobserved exploitationCWE-863

CVE-2021-21389: high-severity vulnerability in BuddyPress

BuddyPress privilege escalation via REST API

Published · Updated

Follow this CVE+ Monitor BuddyPress+ Monitor buddypress/buddypress

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

83Vexday Risk Score

Patch now. It exploitation observed by VulnCheck and has a working public exploit.

ssvc Actcvss 8.1epss 15%
from disclosure to weapon66 days
Published on NVDMar 26
1st PoC+66d
VulnCheck+978d
BuddyPress is an open source WordPress plugin to build a community site. In releases of BuddyPress from 5.0.0 before 7.2.1 it's possible for a non-privileged, regular user to obtain administrator rights by exploiting an issue in the REST API members endpoint. The vulnerability has been fixed in BuddyPress 7.2.1. Existing installations of the plugin should be updated to this version to mitigate the issue.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
Affected products
buddypress · BuddyPress
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
Related CVEs — BuddyPress

In the same product, most dangerous first.

CVE-2020-5244HIGHPrivate data exposure via REST API in BuddyPressEPSS 2.4%CVE-2026-1360HIGHBuddyPress <= 14.5.0 - Authenticated (Subscriber+) PHP Object Injection via XProfile Field DataEPSS 1.2%CVE-2024-10011HIGHBuddyPress <= 14.1.0 - Authenticated (Subscriber+) Directory TraversalEPSS 1.2%CVE-2024-11976HIGHBuddyPress <= 14.3.3 - Unauthenticated Arbitrary Shortcode ExecutionEPSS 0.6%CVE-2024-3974MEDIUMBuddyPress <= 12.4.0 - Authenticated (Subscriber+) Stored Cross-Site ScriptingEPSS 0.4%CVE-2024-4892MEDIUMBuddyPress <= 12.4.1 - Authenticated (Subscriber+) Stored Cross-Site ScriptingEPSS 0.4%