BuddyBoss Platform: Privilege escalation for subscribers in WordPress plugin
The WordPress plugin BuddyBoss Platform up to and including version 3.5.0 contains a privilege escalation vulnerability (CWE-266). An attacker with a low-privileged Subscriber account can gain higher privileges, potentially up to administrator and full control of the website. The attack is possible over the network without user interaction, so sites with open registration are at highest risk.
BuddyBoss · Buddyboss Platform
