The BuddyTask plugin for WordPress suffers from a missing authorization (CWE-862) vulnerability affecting all versions up to 1.3.0. Multiple AJAX endpoints lack proper capability checks, enabling authenticated users with low privileges (Subscriber-level and above) to access and manipulate task boards of any BuddyPress group, including private and hidden ones. This flaw allows unauthorized viewing, creation, modification, and deletion of group task boards, violating intended access controls. The CVSS 3.1 base score is 5.4 (medium severity), reflecting network attack vector, low attack complexity, and limited confidentiality and integrity impact without availability impact. No patch or official remediation guidance is currently available.

The vulnerability allows authenticated users with minimal privileges to bypass access controls and perform unauthorized actions on task boards belonging to any BuddyPress group, including private and hidden groups. This can lead to unauthorized disclosure and modification of group task data. There is no indication of availability impact. No known exploitation in the wild has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict user roles to trusted users only and monitor for suspicious activity related to BuddyTask AJAX endpoints. Avoid granting Subscriber-level or higher access to untrusted users. Follow vendor channels for updates and apply patches promptly once available.