This vulnerability in BuddyDev Activity Plus Reloaded for BuddyPress arises from missing authorization checks, allowing users with limited privileges to perform actions they should not be authorized to execute. The issue affects all versions up to 1.1.2. The CVSS vector indicates the attack can be performed remotely over the network with low complexity and requires low privileges but no user interaction. The impact includes limited integrity and availability loss but no confidentiality impact. No vendor advisory or patch information is provided, and no known exploits have been reported.

Exploitation of this vulnerability could allow an attacker with limited privileges to perform unauthorized actions within the affected plugin, potentially leading to integrity and availability issues. Confidentiality is not impacted. There are no reports of active exploitation in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, review and restrict user privileges carefully to limit potential exploitation. Monitor official BuddyDev channels for updates or patches addressing this vulnerability.