CVE-2026-53673: BuddyPress 14.4.0 Private Message IDOR via REST API user_id Parameter

Synopsis

An insecure direct object reference (IDOR) vulnerability exists in BuddyPress 14.4.0's messages REST API. The flaw is reachable over the network by any authenticated user and requires no special privileges; an attacker supplies another user's identifier in the user_id parameter, bypassing the ownership check in get_item_permissions_check, which is shared by the read, reply, and delete handlers. Successful exploitation lets an attacker read, tamper with, or delete any user's private message threads. No fix version has been published; HarborGuard is tracking the advisory for patch availability.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The vulnerable REST API endpoint is exposed over the network, so an attacker must be able to reach the WordPress/BuddyPress service via HTTP/HTTPS.

• AuthenticationRequired

  Any low-privilege account is sufficient; the attacker only needs a valid WordPress login to issue REST API requests with an arbitrary user_id parameter.

• Victim interactionNot required

  No victim interaction is needed; the attacker sends crafted API requests directly without requiring any action from the targeted user.

• Attack complexityDetail

  Attack complexity is low; exploitation is reliable and condition-free, requiring only a well-formed REST API request with a substituted user_id value.

Blast Radius

• Reads the full contents of any user's private message threads, exposing confidential conversations and any sensitive data shared within them.
• Sends replies into any user's private message inbox, enabling impersonation or social-engineering attacks against other users.
• Permanently deletes any user's private messages, causing irreversible loss of message history across the platform.
• No availability impact on the hosting service itself; the vulnerability does not affect system uptime or process stability.