CVE Feed

    Dashboard / CVE / CVE-2021-21389

    CVE-2021-21389

    BuddyPress is an open source WordPress plugin to build a community site. In releases of BuddyPress from 5.0.0 before 7.2.1 it's possible for a non-privileged, regular user to obtain administrator rights by exploiting an issue in the REST API members endpoint. The vulnerability has been fixed in BuddyPress 7.2.1. Existing installations of the plugin should be updated to this version to mitigate the issue.

    Published:Mar 26, 2021
    Last Modified:Nov 21, 2024
    EPS:Mar 26, 2021
    EPSS Score:0.93537
    CVSS Score:8.1

    Affected Products

    Vendor
    Buddypress
    Product
    Buddypress

    Exploits

    https://github.com/HoangKien1020/CVE-2021-21389https://github.com/mynameSumin/CVE-2021-21389

    Common Weakness Enumeration

    CWE-863 Incorrect Authorization

    Common Attack Pattern Enumeration and Classification (CAPEC)

    No CAPEC recorded yet

    Related CVEs

    CVE-2026-8155 (CVSS 5.4) — The BuddyPress WordPress plugin before 14.5.0 does not properly enforce authorization on its private messaging…
    CVE-2026-1360 (CVSS 7.5) — The BuddyPress plugin for WordPress is vulnerable to Deserialization of Untrusted Data in all versions up to, …
    CVE-2026-53675 (CVSS 5.3) — BuddyPress 14.4.0 contains an insecure direct object reference vulnerability in the friends REST API that allo…
    CVE-2026-53674 (CVSS 7.1) — BuddyPress 14.4.0 contains a regular expression injection vulnerability in the activity mention resolver that,…
    CVE-2026-53673 (CVSS 8.6) — BuddyPress 14.4.0 contains an insecure direct object reference vulnerability in the messages REST API that all…
    CVE-2018-25308 (CVSS 8.7) — BuddyPress Xprofile Custom Fields Type 2.6.3 contains a remote code execution vulnerability that allows authen…
    CVE-2024-11976 (CVSS 7.3) — The The BuddyPress plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, …
    CVE-2025-62760 (CVSS 6.5) — Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in BuddyDev…
    CVE-2025-9218 (CVSS 3.7) — The rtMedia for WordPress, BuddyPress and bbPress plugin for WordPress is vulnerable to to Information Disclos…
    CVE-2025-12391 (CVSS 5.3) — The Restrictions for BuddyPress plugin for WordPress is vulnerable to unauthorized modification of data due to…

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High