CVE-2021-21389highexplotación observadaCWE-863

CVE-2021-21389: fallo de gravedad alta en BuddyPress

BuddyPress privilege escalation via REST API

Publicada el · Actualizada el

Seguir esta CVE+ Monitorear BuddyPress+ Monitorear buddypress/buddypress

Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.

83Vexday Risk Score

Corrige ahora. Ella explotación observada por VulnCheck y tiene exploit funcional público.

ssvc Actcvss 8.1epss 15%
de la publicación al arma66 días
Publicada en NVD26 mar
1ª PoC+66d
VulnCheck+978d
BuddyPress is an open source WordPress plugin to build a community site. In releases of BuddyPress from 5.0.0 before 7.2.1 it's possible for a non-privileged, regular user to obtain administrator rights by exploiting an issue in the REST API members endpoint. The vulnerability has been fixed in BuddyPress 7.2.1. Existing installations of the plugin should be updated to this version to mitigate the issue.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
Productos afectados
buddypress · BuddyPress
⚠ Recursos públicos, para evaluar la exposición de sistemas que controlas o estás autorizado a probar. Prueba solo con autorización.
CVEs relacionadas — BuddyPress

En el mismo producto, de las más peligrosas a las menos.

CVE-2020-5244HIGHPrivate data exposure via REST API in BuddyPressEPSS 2.4%CVE-2026-1360HIGHBuddyPress <= 14.5.0 - Authenticated (Subscriber+) PHP Object Injection via XProfile Field DataEPSS 1.2%CVE-2024-10011HIGHBuddyPress <= 14.1.0 - Authenticated (Subscriber+) Directory TraversalEPSS 1.2%CVE-2024-11976HIGHBuddyPress <= 14.3.3 - Unauthenticated Arbitrary Shortcode ExecutionEPSS 0.6%CVE-2024-3974MEDIUMBuddyPress <= 12.4.0 - Authenticated (Subscriber+) Stored Cross-Site ScriptingEPSS 0.4%CVE-2024-4892MEDIUMBuddyPress <= 12.4.1 - Authenticated (Subscriber+) Stored Cross-Site ScriptingEPSS 0.4%